Windows JScript: Remote code execution through integer overflow

Summary

A flaw in the Microsoft JScript scripting engine on Windows allows an attacker to execute code remotely. The CNA record classifies it as an integer overflow or wraparound leading to a heap-based buffer overflow (CWE-122, CWE-190). Exploitation has high complexity and requires user interaction, such as a victim opening or running attacker-controlled script content. A successful attack can fully compromise confidentiality, integrity and availability on the affected system.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): builds 10.0.14393.0 before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds 10.0.17763.0 before 10.0.17763.9487
• Windows 10 Version 21H2: builds 10.0.19044.0 before 10.0.19044.7846
• Windows 10 Version 22H2: builds 10.0.19045.0 before 10.0.19045.7846
• Windows 11 Version 23H2: builds 10.0.22631.0 before 10.0.22631.7711
• Windows 11 Version 24H2: builds 10.0.26100.0 before 10.0.26100.9974
• Windows 11 Version 25H2: builds 10.0.26200.0 before 10.0.26200.9974
• Windows 11 Version 26H1: builds 10.0.28000.0 before 10.0.28000.3501
• Windows 11 Version 26H2: builds 10.0.26300.0 before 10.0.26300.9974
• Windows Server 2022: builds 10.0.20348.0 before 10.0.20348.5870

Fixed in

• Fixed in the November 2026 security updates. The fixed builds are listed as the first builds not affected in the CVE record: 10.0.14393.9688, 10.0.17763.9487, 10.0.19044.7846, 10.0.19045.7846, 10.0.22631.7711, 10.0.26100.9974, 10.0.26200.9974, 10.0.28000.3501, 10.0.26300.9974, 10.0.20348.5870.
• Corresponding KB numbers: Unknown. Verify on MSRC before rollout.

Workaround

• No vendor workaround found. Apply the security update.
• Where Windows Script Host or other JScript hosting components are not required, consider restricting them. Test before enforcing.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total.
• No evidence of exploitation in the wild found.
• No public proof of concept found.
• Microsoft's per-CVE exploitability assessment: Unknown.

Our recommendation

• Patch affected Windows workstations and servers with the November 2026 cumulative update, starting with systems that have local administrator rights or handle email and web content.
• Check the installed build numbers against the fixed builds above and against the MSRC advisory.
• Monitor for unusual script execution, for example via Windows Script Host, and restrict these components where they are not needed.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-112985 msrc.microsoft.com
• CVE Record CVE-2026-112985 www.cve.org
• Strix: CVE-2026-112985 www.strix.ai
• Action1: Patch Tuesday November 2026 www.action1.com
• HKCERT security bulletin: Windows JScript integer overflow RCE www.hkcert.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:56.