Windows FSRM Service: Out-of-bounds read allows privilege escalation

Summary

An out-of-bounds read in the Windows File Server Resource Management Service (FSRM) allows an unauthorized attacker to elevate privileges over a network. The CVSS vector requires no privileges but user interaction, and attack complexity is high. The affected Windows Server editions are listed in the CVE record; client Windows editions were not covered by the sources reviewed.

Affected

• Windows Server 2016 and Server 2016 (Server Core): builds 10.0.14393.0 to below 10.0.14393.9688
• Windows Server 2019 and Server 2019 (Server Core): builds 10.0.17763.0 to below 10.0.17763.9487
• Windows Server 2022: builds 10.0.20348.0 to below 10.0.20348.5870
• Windows Server 2025 and Server 2025 (Server Core): builds 10.0.26100.0 to below 10.0.26100.33822

Fixed in

• Install the November 2026 cumulative update for each affected edition, bringing builds to at least 10.0.14393.9688, 10.0.17763.9487, 10.0.20348.5870 or 10.0.26100.33822.
• Confirm the KB numbers on the MSRC advisory page; the sources reviewed did not confirm them for every edition.

Workaround

• No vendor-documented workaround found.
• If patching is delayed, identify which file servers have the FSRM role installed, since this determines exposure.

Exploitation

• No evidence of exploitation in the wild found at the time of research.
• CISA SSVC: exploitation none, not automatable, total technical impact.
• Rapid7 rates exploitation as less likely; no public disclosure or public proof of concept found.
• Not in the CISA KEV catalog as of the research (catalog not checked directly).

Our recommendation

• Inventory Windows Server file servers and check whether FSRM is installed.
• Apply the November 2026 cumulative update to affected servers within the normal monthly cycle, after confirming the build list on the MSRC page.
• Check that file servers have no SMB or management ports open to the internet.
• Patch CVE-2026-113765 (FSRM heap overflow, local privilege escalation) in the same release.
• Monitor for unusual privilege changes on file servers.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide (MSRC) msrc.microsoft.com
• CVE Record CVE-2026-108421 www.cve.org
• Strix CVE-2026-108421 www.strix.ai
• Rapid7 Patch Tuesday November 2026 (EM) www.rapid7.com
• Action1 Patch Tuesday November 2026 www.action1.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 06:06.