Windows Kernel: Heap-based buffer overflow enables privilege escalation

Summary

Microsoft Windows Kernel contains a heap-based buffer overflow (CWE-122) that allows an authorized local attacker to elevate privileges. The attack requires physical access to the device and a valid low-privilege account, and the vulnerability is not reachable over the network. Microsoft fixed the flaw in the November 2026 Patch Tuesday updates, and no public exploit is known. The CVSS 3.1 base score is 6.6 (Medium).

Affected

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.0 to before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019: 10.0.17763.0 to before 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870
• Windows Server 2025: Unknown.

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.9688 or later
• Windows 10 Version 1809 and Windows Server 2019: 10.0.17763.9487 or later
• Windows 10 Version 21H2: 10.0.19044.7846 or later
• Windows 10 Version 22H2: 10.0.19045.7846 or later
• Windows 11 Version 23H2: 10.0.22631.7711 or later
• Windows 11 Version 24H2: 10.0.26100.9974 or later
• Windows 11 Version 25H2: 10.0.26200.9974 or later
• Windows 11 Version 26H1: 10.0.28000.3501 or later
• Windows 11 Version 26H2: 10.0.26300.9974 or later
• Windows Server 2022: 10.0.20348.5870 or later
• Windows Server 2025: Unknown.
• Confirm the matching cumulative update on the MSRC page before deployment.

Workaround

• No workaround is documented in the sources.
• General measures, not from a source: restrict physical access to shared or unattended PCs, enable BitLocker and Secure Boot, protect BIOS/UEFI settings, and limit local accounts and admin rights.

Exploitation

• MSRC states that no publicly available exploit code exists or that an exploit is theoretical.
• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• Rapid7 rates exploitation as less likely.
• Not confirmed: CISA KEV listing (a third-party source claims it is listed; not verified).

Our recommendation

• Install the November 2026 security updates on all affected Windows 10, 11 and Server systems, and confirm the correct update on the MSRC page first.
• Prioritise shared workstations, reception and kiosk PCs, and devices that leave the office.
• Restrict physical access and limit local accounts and admin rights.
• Enable BitLocker and Secure Boot where possible.
• Monitor for unexpected privilege changes on endpoints.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-112969 msrc.microsoft.com
• CVE Program release (cvelistV5) github.com
• Rapid7: Patch Tuesday November 2026 www.rapid7.com
• Action1: Patch Tuesday November 2026 www.action1.com
• BleepingComputer: Microsoft November 2026 Patch Tuesday www.bleepingcomputer.com
• Strix.ai: CVE-2026-112969 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 11:47.