Windows WinHTTP: Information disclosure via out-of-bounds read

Summary

The Windows WinHTTP component, the HTTP client API used by Windows and applications for outbound web requests, contains an out-of-bounds read (CWE-125). An authorized local user can read memory outside the intended buffer and disclose information. Exploitation requires local access, existing low-privilege credentials and a high attack complexity, and the flaw cannot be reached from the internet by itself.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): builds before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9487
• Windows 10 Version 21H2: builds before 10.0.19044.7846
• Windows 10 Version 22H2: builds before 10.0.19045.7846
• Windows 11 Version 23H2: builds before 10.0.22631.7711
• Windows 11 Version 24H2: builds before 10.0.26100.9974
• Windows 11 Version 25H2: builds before 10.0.26200.9974
• Windows 11 Version 26H1: builds before 10.0.28000.3501
• Windows 11 Version 26H2: builds before 10.0.26300.9974
• Windows Server 2022: builds before 10.0.20348.5870

Fixed in

• Install the November 2026 cumulative update for each affected build.
• Fixed builds according to the official CVE record are listed under affected as the first build without the vulnerability.
• Sources disagree on some builds (for example Windows 11 24H2 and Windows Server 2025). Verify the exact build list in the MSRC Security Update Guide before rollout.

Workaround

Unknown.

Exploitation

• Microsoft marks the vulnerability as not exploited.
• CISA SSVC assessment: exploitation none, not automatable, partial technical impact.
• The CVE record uses the temporal vector E:U (unproven exploit).
• No public proof-of-concept and no CISA KEV entry were found at the time of research.

Our recommendation

• Deploy the November 2026 cumulative update on all affected Windows 10, Windows 11 and Windows Server systems through the normal patch cycle.
• Prioritise multi-user systems such as terminal servers, RDS hosts, shared jump hosts and workstations where untrusted users or malware could run code.
• Verify the build list in the MSRC advisory before the rollout, because the sources differ on some builds.
• Re-check the advisory and KEV status in the coming days, as this record is very recent.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-108423 msrc.microsoft.com
• CVE Record CVE-2026-108423 (CVE Program) www.cve.org
• Strix: CVE-2026-108423 (third-party, verify against MSRC) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:58.