Windows Management Instrumentation: Heap-based buffer overflow

Summary

A heap-based buffer overflow in Windows Management Instrumentation (WMI) allows a local attacker to execute code. The CVE record lists a range of Windows 10, Windows 11 and Windows Server versions as affected. Exploitation requires local access and user interaction, so an attacker would typically need a foothold on the system first, for example through phishing or a compromised account.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): builds before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9487
• Windows 10 Version 21H2: builds before 10.0.19044.7846
• Windows 10 Version 22H2: builds before 10.0.19045.7846
• Windows 11 Version 23H2: builds before 10.0.22631.7711
• Windows 11 Version 24H2: builds before 10.0.26100.9974
• Windows 11 Version 25H2 and Version 26H2: builds before 10.0.26200.9974 and 10.0.26300.9974
• Windows 11 Version 26H1: builds before 10.0.28000.3501
• Windows Server 2022: builds before 10.0.20348.5870

Source: CVE record excerpt. Other sources conflict on some builds; verify on MSRC.

Fixed in

• Fixed in the November 2026 security updates for the affected Windows versions.
• Minimum fixed builds: see the affected list above (10.0.14393.9688, 10.0.17763.9487, 10.0.19044.7846, 10.0.19045.7846, 10.0.22631.7711, 10.0.26100.9974, 10.0.26200.9974, 10.0.26300.9974, 10.0.28000.3501, 10.0.20348.5870).
• KB mapping is not yet confirmed by MSRC; third-party pages list KB5132059 (Windows 11 26H1) and KB5131096 (Windows 10 21H2).

Workaround

Unknown.

Exploitation

• Not known to be exploited in the wild (CISA SSVC: Exploitation none; CVSS exploit maturity Unproven).
• Automatable: no.
• No public proof-of-concept exploit found.

Our recommendation

• Install the November 2026 cumulative update on all affected Windows workstations and servers, starting with terminal servers, file servers and shared workstations.
• Confirm in WSUS or Intune that the update is part of the deployment baseline and test it on one representative host per Windows version first.
• Check the MSRC advisory for confirmed affected builds, the KB mapping, attack vector and any listed mitigations.
• Restrict local logon to necessary users and review accounts with local access to reduce the risk of a foothold.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE.org record CVE-2026-105580 www.cve.org
• Microsoft Security Update Guide CVE-2026-105580 msrc.microsoft.com
• Senserva KB5132059 (Windows 11 26H1, November 2026) senserva.com
• Senserva KB5131096 (Windows 10 21H2, November 2026) senserva.com
• Strix.ai CVE-2026-105580 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:31.