Windows 10 Version 1607: Heap-based buffer overflow in Windows Update

Summary

A heap-based buffer overflow in the Windows Update component of Windows 10 Version 1607 and Windows Server 2016 allows an authorized local user to elevate privileges. An attacker needs local access and low privileges, so this is not a remote entry point. The main risk is a user or malware already running on an affected device, especially on shared or poorly managed endpoints.

Affected

• Windows 10 Version 1607 (build 10.0.14393.0 to < 10.0.14393.9612)
• Windows Server 2016 and Server Core installation (build 10.0.14393.0 to < 10.0.14393.9612)
• Other Windows 10, Windows 11 and Windows Server versions are also listed in the official advisory; check the MSRC page for the full list.

Fixed in

• Build 10.0.14393.9612 or later for Windows 10 Version 1607 and Windows Server 2016.
• Microsoft release health lists OS Build 14393.9612 with KB5126868 (released 2026-10-13). The KB-to-CVE mapping could not be confirmed on the MSRC page.

Workaround

• No vendor workaround is known. Install the security update from the official advisory.
• Restrict local logon to trusted users on affected devices until patched.

Exploitation

• Microsoft did not publicly disclose the vulnerability and reports no exploit code at release.
• No known exploitation in the wild was found at the time of research.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• EPSS is low (about 0.003).

Our recommendation

• Identify all Windows 10 Version 1607 and Windows Server 2016 systems, including Server Core and LTSB devices.
• Install KB5126868 or the latest cumulative update (build 14393.9612 or later) immediately where possible.
• Because Windows 10 Version 1607 reaches end of extended support on 13 October 2026, plan migration to a supported release or enrol in Extended Security Updates (ESU) for devices that cannot be migrated.
• Restrict local logon and monitor endpoints for privilege escalation activity.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-69633 msrc.microsoft.com
• Microsoft release health: Windows 10 1607 and Windows Server 2016 learn.microsoft.com
• Microsoft release health: release information learn.microsoft.com
• 4sysops: Windows 10 LTSB 2016 end of support and ESU 4sysops.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 04:54.