Microsoft Sysinternals Suite: Stack-based buffer overflow leads to local privilege escalation

Summary

A stack-based buffer overflow (CWE-121) in Microsoft Sysinternals Suite allows an authorized local attacker with low privileges to elevate privileges. CVSS 7.3 (High) assumes that user interaction is required and that the attacker already has local access, for example after phishing or malware infection. The flaw is not reachable from the network, and the affected version range is contradictory in the available sources.

Affected

• Microsoft Sysinternals Suite
• The affected version range is contradictory across sources (listed as 3.0.0 to < 1.03; VulDB refers to versions up to 1.2). Unconfirmed; check the MSRC advisory.

Fixed in

Unknown. Check the "Affected products" table on the MSRC advisory and the Sysinternals release notes.

Workaround

No vendor workaround known.

Exploitation

• Microsoft rates exploit code maturity as Unproven (E:U), meaning no known exploit code.
• No public proof of concept found; the search was limited.
• Not listed in CISA KEV according to Strix; no known in-the-wild exploitation.
• EPSS at last check: 0.00463 (low).

Our recommendation

• Confirm affected and fixed versions on the MSRC advisory.
• Until a fixed version is confirmed, remove or replace Sysinternals tools on shared machines, terminal servers and non-admin endpoints.
• Limit interactive local logon to trusted admin accounts.
• Keep endpoint protection and application control active and monitor admin workstations for unexpected privilege changes.
• Priority: medium; escalate if exploitation is reported.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-105732 msrc.microsoft.com
• VulDB entry 418186 vuldb.com
• Vulners NVD mirror vulners.com
• Strix CVE record www.strix.ai
• CWE-121 description (CIRCL) vulnerability.circl.lu

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 3 Nov 2026, 02:11.