Microsoft JScript: Remote code execution vulnerability

Summary

An integer overflow or wraparound in the Microsoft JScript scripting engine of Windows allows an unauthenticated attacker to execute code over the network. Exploitation is rated high complexity and requires user interaction, for example opening a crafted web page or file. The CVSS 3.1 base score is 7.5 (High).

Affected

• Windows 10 Version 1607 (builds 10.0.14393.0 to before 10.0.14393.9688)
• Windows 10 Version 1809 (builds 10.0.17763.0 to before 10.0.17763.9487)
• Windows 10 Version 21H2 (builds 10.0.19044.0 to before 10.0.19044.7846)
• Windows 10 Version 22H2 (builds 10.0.19045.0 to before 10.0.19045.7846)
• Windows 11 Version 23H2 (builds 10.0.22631.0 to before 10.0.22631.7711)
• Windows 11 Version 24H2 (builds 10.0.26100.0 to before 10.0.26100.9974)
• Windows 11 Version 25H2 (builds 10.0.26200.0 to before 10.0.26200.9974)
• Windows 11 Version 26H1 (builds 10.0.28000.0 to before 10.0.28000.3501)
• Windows 11 Version 26H2 (builds 10.0.26300.0 to before 10.0.26300.9974)
• Windows Server 2016, including Server Core (builds 10.0.14393.0 to before 10.0.14393.9688)
• Windows Server 2019, including Server Core (builds 10.0.17763.0 to before 10.0.17763.9487)
• Windows Server 2022 (builds 10.0.20348.0 to before 10.0.20348.5870)

Fixed in

Fixed in Microsoft's November 2026 security update. Fixed builds according to the CVE record:

• 10.0.14393.9688 (Windows 10 1607, Server 2016)
• 10.0.17763.9487 (Windows 10 1809, Server 2019)
• 10.0.19044.7846 (Windows 10 21H2)
• 10.0.19045.7846 (Windows 10 22H2)
• 10.0.22631.7711 (Windows 11 23H2)
• 10.0.26100.9974 (Windows 11 24H2)
• 10.0.26200.9974 (Windows 11 25H2)
• 10.0.28000.3501 (Windows 11 26H1)
• 10.0.26300.9974 (Windows 11 26H2)
• 10.0.20348.5870 (Windows Server 2022)

KB numbers: Unknown. Confirm them on the MSRC advisory page.

Workaround

Unknown. No vendor-published workaround was identified. Restricting JScript or legacy script execution by policy where it is not required may reduce exposure; this is a general suggestion, not a vendor recommendation.

Exploitation

• No exploitation in the wild was found at the time of research.
• No public proof of concept was found.
• CISA SSVC assessment: exploitation none, automatable no, technical impact total.
• CISA KEV status: not checked.

Our recommendation

• Install the November 2026 security update on all affected Windows clients and servers, starting with hosts that have browser or mail access.
• Verify the installed build against the MSRC advisory before and after rollout.
• Restrict legacy script execution where it is not needed.
• Filter or sandbox untrusted scripts and attachments at mail and web gateways.
• Monitor endpoints for unexpected script execution.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record CVE-2026-105578 (CVE Program) www.cve.org
• MSRC Security Update Guide: CVE-2026-105578 msrc.microsoft.com
• BleepingComputer: Microsoft November 2026 Patch Tuesday www.bleepingcomputer.com
• Rapid7: November 2026 Patch Tuesday www.rapid7.com
• Strix: CVE-2026-105578 (third-party tracker, unverified) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 06:07.