Windows 10 1607: Local privilege escalation via buffer over-read in GDI

Summary

A buffer over-read in the Windows Graphics Device Interface (GDI) allows a local user with low privileges to elevate their privileges on affected Windows 10 Version 1607 systems. The flaw is not reachable from the network; the attacker needs a valid low-privilege account or existing code execution on the host. Successful exploitation can fully compromise the affected system (CVSS 7.8, CWE-126).

Affected

• Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9612
• Windows Server 2016: 10.0.14393.0 to before 10.0.14393.9612
• The same CNA record also lists other Windows 10, Windows 11 and Windows Server builds.

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: build 10.0.14393.9612 or later (October 2026 update)
• Verify the exact KB number and build in the MSRC Security Update Guide before rollout.

Workaround

• No vendor workaround known. Installing the security update is the fix.
• Interim measure if patching is delayed (own recommendation, not from the vendor): restrict local logon to trusted users, especially on shared hosts such as terminal servers.

Exploitation

• Microsoft lists the vulnerability as not exploited.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• EPSS about 0.0034 in mid-October 2026 (low probability signal).
• No public proof of concept found in the searches performed; this is not conclusive.
• No known in-the-wild use or CISA KEV listing.

Our recommendation

• Apply the October 2026 Microsoft security update to all affected Windows 10 1607 and Server 2016 systems, then restart them.
• Prioritise multi-user hosts such as RDS/terminal servers, shared workstations and kiosks.
• Verify the lifecycle status of Windows 10 1607 with Microsoft; plan upgrades if the platform is no longer supported.
• Apply least privilege to user accounts and monitor for suspicious local privilege escalation activity.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-69884 msrc.microsoft.com
• CVE List record (CNA) via Vulners vulners.com
• NVD mirror and EPSS via Vulners vulners.com
• OpenCVE: CVE-2026-69884 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 04:46.