Windows Shell: Remote code execution via heap-based buffer overflow

Summary

A heap-based buffer overflow in Windows Shell, the desktop and File Explorer layer of Windows, allows an unauthenticated attacker to execute code over the network. The CVSS vector rates attack complexity as high and requires user interaction, so an attack most likely depends on a user opening or interacting with crafted content. Microsoft rates confidentiality, integrity and availability impact as high, and the exact trigger is not described in the sources.

Affected

• Windows 10 Version 1607 (builds 10.0.14393.0 before 10.0.14393.9688)
• Windows 10 Version 1809 (builds 10.0.17763.0 before 10.0.17763.9487)
• Windows 10 Version 21H2 (builds 10.0.19044.0 before 10.0.19044.7846)
• Windows 10 Version 22H2 (builds 10.0.19045.0 before 10.0.19045.7846)
• Windows 11 Version 23H2 (builds 10.0.22631.0 before 10.0.22631.7711)
• Windows 11 Version 24H2 (builds 10.0.26100.0 before 10.0.26100.9974)
• Windows 11 Version 25H2 (builds 10.0.26200.0 before 10.0.26200.9974)
• Windows 11 Version 26H1 (builds 10.0.28000.0 before 10.0.28000.3501)
• Windows 11 Version 26H2 (builds 10.0.26300.0 before 10.0.26300.9974)
• Windows Server 2016 incl. Server Core (builds 10.0.14393.0 before 10.0.14393.9688)
• Windows Server 2019 incl. Server Core (builds 10.0.17763.0 before 10.0.17763.9487)
• Windows Server 2022 (builds 10.0.20348.0 before 10.0.20348.5870)
• Windows Server 2025: not listed in the CVE record; unknown.

Fixed in

• Windows 10 1607 / Server 2016: build 10.0.14393.9688 or later
• Windows 10 1809 / Server 2019: build 10.0.17763.9487 or later
• Windows 10 21H2: build 10.0.19044.7846 or later
• Windows 10 22H2: build 10.0.19045.7846 or later
• Windows 11 23H2: build 10.0.22631.7711 or later
• Windows 11 24H2: build 10.0.26100.9974 or later
• Windows 11 25H2: build 10.0.26200.9974 or later
• Windows 11 26H1: build 10.0.28000.3501 or later
• Windows 11 26H2: build 10.0.26300.9974 or later
• Windows Server 2022: build 10.0.20348.5870 or later
• Cumulative update (KB) numbers: Unknown.

Workaround

Unknown. No mitigation was found in the sources; install the fixed cumulative updates.

Exploitation

• Exploited in the wild: no evidence found in the sources; CISA SSVC rates exploitation as none.
• Public proof of concept: none found.
• Microsoft's temporal score rates exploit code maturity as unproven (E:U).

Our recommendation

• Identify affected Windows 10, Windows 11 and Windows Server systems and confirm the exact KB numbers on the MSRC advisory.
• Install the fixed cumulative update through the normal monthly patch cycle, starting with user workstations.
• Check the support status of Windows 10 1607, 1809 and 21H2 systems, as unsupported systems may not receive the fix.
• Re-check exploitation status (CISA KEV, public proof of concept) in the coming days, as the CVE was published only recently.
• Warn users about opening unexpected files from email or file shares.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE.org record CVE-2026-119938 www.cve.org
• Microsoft Security Response Center advisory msrc.microsoft.com
• Strix CVE summary (third-party, unverified rows) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:27.