Windows Management Instrumentation: Information disclosure via buffer over-read

Summary

A buffer over-read in Windows Management Instrumentation (WMI) allows an authorized attacker to read memory contents beyond the intended buffer and disclose information. The attacker needs a local, low-privileged account; the issue is not remotely exploitable on its own. The impact is limited to confidentiality, with no integrity or availability impact according to the CVSS vector.

Affected

• Windows 10 Version 1607, 1809, 21H2, 22H2
• Windows 11 Version 23H2, 24H2, 25H2, 26H1, 26H2
• Windows Server 2016 (including Server Core), 2019 (including Server Core), 2022
• Windows Server 2025: listed as fixed by the November 2026 update KB5131080 in a secondary source; exact affected range not confirmed by Microsoft in the sources reviewed

Fixed in

• Windows 10 1607 and Server 2016: 10.0.14393.9688
• Windows 10 1809 and Server 2019: 10.0.17763.9487
• Windows 10 21H2: 10.0.19044.7846
• Windows 10 22H2: 10.0.19045.7846
• Windows 11 23H2: 10.0.22631.7711
• Windows 11 24H2: 10.0.26100.9974
• Windows 11 25H2: 10.0.26200.9974
• Windows 11 26H1: 10.0.28000.3501
• Windows 11 26H2: 10.0.26300.9974
• Windows Server 2022: 10.0.20348.5870
• Windows Server 2025: Unknown; verify the build in the MSRC table

Workaround

Unknown. No vendor workaround was identified; apply the security update.

Exploitation

• Not publicly disclosed and not known to be exploited, according to Microsoft.
• Microsoft's exploitability assessment: Exploitation Less Likely.
• No public exploit code found.
• CISA SSVC: exploitation none, not automatable.
• CISA KEV listing not verified.

Our recommendation

• Install the November 2026 Windows security updates on all affected servers and clients, starting with multi-user hosts such as Remote Desktop or terminal servers and shared file or application servers.
• Verify the exact fixed build for Windows Server 2025 and any other edition in the MSRC table before rollout.
• Limit local interactive and low-privileged logons on servers where possible.
• Keep this in the regular monthly patch cycle, as information leaks can support other attacks.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-108410 msrc.microsoft.com
• CVE.org record CVE-2026-108410 (Microsoft as CNA) www.cve.org
• Update summary KB5131080 (secondary) senserva.com
• Strix CVE summary (aggregator, unverified) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 16:57.