Windows OLE DB: Heap-based buffer overflow enables local privilege escalation

Summary

Windows OLE DB contains a heap-based buffer overflow (CWE-122) that allows an authorized local attacker to elevate privileges. An attacker needs an existing local logon with low privileges and must overcome high attack complexity. Successful exploitation would have a high impact on confidentiality, integrity and availability (CVSS 3.1: 7.0). Microsoft released fixes with the November 2026 Patch Tuesday.

Affected

• Windows 10 Version 1607, 1809, 21H2 and 22H2 (builds below the fixed builds listed below)
• Windows 11 Version 23H2 (affected builds below 10.0.22631.7711)
• Windows 11 Version 24H2, 25H2, 26H1 and 26H2 (listed in the CVE record; not confirmed, check MSRC)
• Windows Server 2016 (including Server Core), 2019 (including Server Core) and 2022
• Windows 10 1607 and Server 2016: affected below 10.0.14393.9688
• Windows 10 1809 and Server 2019: affected below 10.0.17763.9487
• Windows 10 21H2: affected below 10.0.19044.7846
• Windows 10 22H2: affected below 10.0.19045.7846
• Windows Server 2022: affected below 10.0.20348.5870

Fixed in

• November 2026 security update (Patch Tuesday, November 10, 2026)
• Fixed builds per CVE record: 10.0.14393.9688 (1607, Server 2016), 10.0.17763.9487 (1809, Server 2019), 10.0.19044.7846 (21H2), 10.0.19045.7846 (22H2), 10.0.22631.7711 (11 23H2), 10.0.20348.5870 (Server 2022)
• KB numbers: not confirmed; verify in the MSRC Security Updates table

Workaround

Unknown.

Exploitation

• No evidence of exploitation in the wild found at the time of research
• No public proof of concept found
• CVE record exploit maturity: Unproven (E:U)
• CISA SSVC: exploitation none, automatable no, technical impact total
• NVD status: Awaiting Analysis

Our recommendation

• Install the November 2026 cumulative update on all affected Windows 10, Windows 11 and Windows Server systems
• Verify the exact KB and fixed build for each OS version in the MSRC Security Update Guide
• Prioritise multi-user systems such as Remote Desktop/terminal servers, file servers and workstations with shared local logon
• Review local accounts and privileged access, as this flaw requires an existing local foothold
• Re-check MSRC and NVD for changes to the exploitation status

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record CVE-2026-105587 (CVE.org) www.cve.org
• Microsoft Security Update Guide CVE-2026-105587 msrc.microsoft.com
• Strix AI mirror CVE-2026-105587 www.strix.ai
• We-Fix-PC: Microsoft November 2026 Patch Tuesday we-fix-pc.com
• Tenable: Microsoft November 2026 Patch Tuesday www.tenable.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:34.