Windows SMB: Remote code execution via heap-based buffer overflow

Summary

A heap-based buffer overflow in the Windows SMB file sharing protocol allows code execution over the network. The attacker must first be authorized with a valid low-privilege account. Successful exploitation could give full control over an affected server or workstation.

Affected

• Windows 10 Version 1607, 1809, 21H2 and 22H2
• Windows 11 Version 23H2, 24H2, 25H2, 26H1 and 26H2
• Windows Server 2016, 2019 and 2022 (including Server Core installations)
• Exact affected build ranges: see the Microsoft Security Update Guide, as the sources differ on some entries.

Fixed in

• Windows 10 1607: 10.0.14393.9688 or later
• Windows 10 1809: 10.0.17763.9487 or later
• Windows 10 21H2: 10.0.19044.7846 or later
• Windows 10 22H2: 10.0.19045.7846 or later
• Windows 11 23H2: 10.0.22631.7711 or later
• Windows 11 24H2, 25H2 and 26H2: 10.0.26100.9974 or later (25H2/26H2 build family 10.0.26200.9974 or 10.0.26300.9974)
• Windows 11 26H1: 10.0.28000.3501 or later
• Windows Server 2016 and 2019: as for the matching Windows 10 builds above
• Windows Server 2022: 10.0.20348.5870 or later
• Fixes are included in the cumulative security updates of November 2026.

Workaround

Unknown. No Microsoft-documented workaround was found. Until patched, general SMB measures apply: block TCP 445 at the perimeter, restrict SMB to required internal segments and disable SMBv1 where still in use. These measures are general practice and should be verified against Microsoft guidance.

Exploitation

• Not known to be exploited in the wild at publication.
• No public proof of concept found.
• The CNA rates exploit maturity as unproven (E:U).
• NVD analysis was still pending at publication.

Our recommendation

• Install the November 2026 cumulative security update on all affected Windows clients and servers, starting with file servers and domain controllers.
• Until patched, block TCP 445 at the perimeter and limit SMB access to required internal systems.
• Disable SMBv1 where it is still in use.
• Check the Microsoft Security Update Guide for the exact affected builds before rollout.
• Monitor for reports of exploitation and reassess priority if they appear.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-122176 msrc.microsoft.com
• CVE.org record: CVE-2026-122176 www.cve.org
• Strix: CVE-2026-122176 www.strix.ai
• Senserva: KB5131096 (November 2026 tracker) senserva.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 21:25.