Windows HID Parser Library: Heap-based buffer overflow allows privilege escalation

Summary

A heap-based buffer overflow in the Windows HID Parser Library allows an unauthorized attacker to elevate privileges on affected Windows systems. The attacker needs physical access to the machine, for example by connecting a manipulated USB or HID device. Internet-facing systems are not directly affected, but shared, public-facing or unattended endpoints are at risk.

Affected

• Windows 10 Version 1607 (builds 10.0.14393.0 to before 10.0.14393.9688)
• Windows 10 Version 1809 (builds 10.0.17763.0 to before 10.0.17763.9487)
• Windows 10 Version 21H2 (builds 10.0.19044.0 to before 10.0.19044.7846)
• Windows 10 Version 22H2 (builds 10.0.19045.0 to before 10.0.19045.7846)
• Windows 11 Version 23H2 (builds 10.0.22631.0 to before 10.0.22631.7711)
• Windows 11 Version 24H2 (builds 10.0.26100.0 to before 10.0.26100.9974)
• Windows 11 Version 25H2 (builds 10.0.26200.0 to before 10.0.26200.9974)
• Windows 11 Version 26H1 (builds 10.0.28000.0 to before 10.0.28000.3501)
• Windows 11 Version 26H2 (builds 10.0.26300.0 to before 10.0.26300.9974)
• Windows Server 2016 incl. Server Core (builds 10.0.14393.0 to before 10.0.14393.9688)
• Windows Server 2019 incl. Server Core (builds 10.0.17763.0 to before 10.0.17763.9487)
• Windows Server 2022 (builds 10.0.20348.0 to before 10.0.20348.5870)

Fixed in

• Install the November 2026 cumulative update for the affected Windows versions, which contains the fix.
• Fixed builds according to the CVE record: 10.0.14393.9688 (1607 and Server 2016), 10.0.17763.9487 (1809 and Server 2019), 10.0.19044.7846 (21H2), 10.0.19045.7846 (22H2), 10.0.22631.7711 (23H2), 10.0.26100.9974 (24H2), 10.0.26200.9974 (25H2), 10.0.28000.3501 (26H1), 10.0.26300.9974 (26H2), 10.0.20348.5870 (Server 2022).
• KB article numbers: Unknown.

Workaround

Unknown. No vendor workaround was found. Patching is the fix.

Exploitation

• CISA SSVC assessment: exploitation none, not automatable, technical impact total.
• No evidence of exploitation in the wild in the sources reviewed.
• No public proof-of-concept found in the search. This does not prove that none exists.

Our recommendation

• Deploy the November 2026 cumulative update to all affected Windows 10 and Windows 11 endpoints and servers, starting with shared and publicly accessible devices.
• Check first whether each system is still on a supported build, because unsupported builds will not receive the fix.
• Until patched, restrict new USB and HID device installation via Group Policy or Intune device-control policies.
• Enforce screen lock on unattended machines and physically secure USB ports on reception, kiosk and meeting-room devices.
• Also patch the related October 2026 CVE-2026-83569 in the same component; it does not replace this update.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-122173 msrc.microsoft.com
• CVE Record: CVE-2026-122173 www.cve.org
• BleepingComputer: Microsoft November 2026 Patch Tuesday www.bleepingcomputer.com
• Rapid7: Patch Tuesday November 2026 www.rapid7.com
• ZDI: November 2026 Security Update Review www.thezdi.com
• MSRC: CVE-2026-83569 (related October 2026 CVE) msrc.microsoft.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 10:34.