Windows exFAT File System: Heap-based buffer overflow leads to privilege escalation
Summary
A heap-based buffer overflow in the Windows exFAT File System allows an authorized local attacker to elevate privileges. The attacker needs a local logon with low privileges, and no user interaction is required. The CVSS 3.1 base score is 7.0 (HIGH). The NVD has not yet analyzed the CVE.
Affected
- Windows 10 Version 1607 and Windows Server 2016 (incl. Server Core): builds 10.0.14393.0 to before 10.0.14393.9688
- Windows 10 Version 1809 and Windows Server 2019 (incl. Server Core): builds 10.0.17763.0 to before 10.0.17763.9487
- Windows 10 Version 21H2: builds 10.0.19044.0 to before 10.0.19044.7846
- Windows 10 Version 22H2: builds 10.0.19045.0 to before 10.0.19045.7846
- Windows 11 Version 23H2: builds 10.0.22631.0 to before 10.0.22631.7711
- Windows 11 Version 24H2: builds 10.0.26100.0 to before 10.0.26100.9974
- Windows 11 Version 25H2: builds 10.0.26200.0 to before 10.0.26200.9974
- Windows 11 Version 26H1: builds 10.0.28000.0 to before 10.0.28000.3501
- Windows 11 Version 26H2: builds 10.0.26300.0 to before 10.0.26300.9974
- Windows Server 2022: builds 10.0.20348.0 to before 10.0.20348.5870
Fixed in
- Install the current cumulative security update so the build is at or above the first fixed build listed above (for example 10.0.19045.7846 for Windows 10 Version 22H2).
- KB numbers: Unknown. Check the MSRC advisory for the exact update per build.
Workaround
- Unknown. No vendor-published workaround was found. Patching is the recommended fix.
Exploitation
- Microsoft's CISA SSVC assessment lists exploitation as none and automatable as no.
- No public proof of concept was found.
- A third-party report mentions in-the-wild exploitation of an unnamed Windows vulnerability in the November 2026 Patch Tuesday, which cannot be confirmed as this CVE.
Our recommendation
- Patch all affected Windows systems in the normal monthly cycle, and prioritize multi-user systems such as file servers and terminal servers.
- Restrict local logon on shared servers and limit which users can work on the system.
- Control the use of removable media such as USB sticks and SD cards.
- Monitor for unexpected privilege changes and suspicious local activity.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows exFAT File System
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5131291, KB5131085, KB5131096, KB5131090, KB5131087, KB5132061
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide (CVE-2026-112804) msrc.microsoft.com
- CVE.org record CVE-2026-112804 www.cve.org
- strix.ai CVE-2026-112804 (third-party aggregator) www.strix.ai
- Rapid7 November 2026 Patch Tuesday roundup www.rapid7.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:13.
Original description (NVD)
Heap-based buffer overflow in Windows exFAT File System allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.