Windows kernel32.dll: Heap-based buffer overflow allows local privilege escalation

Summary

A heap-based buffer overflow in the Windows kernel32.dll library allows an attacker who already has a low-privileged local account to elevate privileges. Successful exploitation can give full control of the affected host (CVSS 7.8 High, C:H/I:H/A:H). The flaw is not directly reachable from the internet, but it is a serious second step after phishing or malware, especially on shared PCs, terminal servers and multi-user file servers.

Affected

• Windows 10 Version 1607 (CPE scope; builds 10.0.14393.0 to below 10.0.14393.9612)
• Windows 10 Version 1809, 21H2, 22H2
• Windows 11 Versions 23H2, 24H2, 25H2, 26H1, 26H2
• Windows Server 2012, 2012 R2 and Server 2016 (including Server Core installations)
• Scope per CNA record; the CPE lists only Windows 10 1607. Verify all editions on the MSRC advisory.

Fixed in

• Windows 10 Version 1607 (and Windows Server 2016): build 10.0.14393.9612, confirmed by the vendor advisory.
• Other fixed builds listed in the CNA record (e.g. 1809: 10.0.17763.9376; 21H2/22H2: 10.0.19044.7807 / 10.0.19045.7807; 23H2: 10.0.22631.7652) are not yet confirmed on the MSRC page and must be checked before rollout.
• Conflicting data exists for Windows 11 24H2 and Server 2025 builds; treat as unconfirmed.

Workaround

Unknown. No vendor workaround found. Apply the Microsoft security update, which replaces the vulnerable kernel32.dll. Restricting local user rights (least privilege) reduces the risk but does not remove it.

Exploitation

• Exploitation in the wild: no evidence found; CISA SSVC lists exploitation as none and automatable as no.
• Public proof-of-concept: none found.
• EPSS: 0.00341 (below 1%), a model score that changes over time.

Our recommendation

• Apply the Microsoft update for CVE-2026-68836 on all affected Windows systems, prioritising multi-user systems, terminal and RDS servers and file servers.
• Check every Windows 10 1607 device: confirm whether it still receives security updates. If it does not, replace or isolate it.
• Limit local accounts and admin rights to the minimum needed.
• Monitor for unusual privilege escalation or new local administrator accounts until patching is complete.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-68836 msrc.microsoft.com
• MSRC advisory (en-US) msrc.microsoft.com
• NVD data via OpenCVE app.opencve.io
• CNA data mirror (Vulners) vulners.com
• NVD record mirror (Vulners) vulners.com
• Microsoft advisory mirror (Vulners) vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 04:57.