Microsoft Windows 10 1607: Elevation of privilege in Kernel Streaming Service driver

Summary

A local elevation of privilege vulnerability in the Kernel Streaming Service driver of Windows 10 Version 1607 is caused by an integer overflow or wraparound (CWE-190). An attacker with a low-privileged local account can use it to gain SYSTEM rights, which would give full control over the affected host. The attacker must already be logged on locally, so the vulnerability is not directly reachable from the internet.

Affected

• Windows 10 Version 1607 (x86 and x64): builds 10.0.14393.0 up to, but not including, 10.0.14393.9612
• Microsoft's CNA record also lists other Windows 10, Windows 11 and Windows Server versions as affected.

Fixed in

• Windows 10 Version 1607: build 10.0.14393.9612 or later (per the Microsoft CNA record; confirm on the MSRC advisory)
• Cumulative update KB for 1607: Unknown. Get it from the MSRC advisory.

Workaround

• Microsoft's full mitigation text was not retrieved. Per a summary, if patching cannot be done immediately, disable or restrict the Microsoft Streaming Service driver via Group Policy or registry. Verify the exact steps in the MSRC advisory before changing anything.
• Disabling the driver may break media applications on the same host; test first.

Exploitation

• No public proof-of-concept exploit found; the search was not exhaustive.
• EPSS is low (about 0.3%).
• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• Not listed in the CISA KEV catalog in the available snapshot; check the live catalog.

Our recommendation

• Install the Microsoft security update for Windows 10 Version 1607 as soon as possible, or at least in the next regular patch cycle.
• Patch sooner on terminal servers, shared multi-user machines and hosts with untrusted local users.
• Check whether any Windows 10 1607 systems are still in use and whether they are still supported under Microsoft's lifecycle policy; unsupported systems should be replaced or isolated.
• Restrict local logons to trusted users and monitor for unexpected privilege escalation.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-69966 msrc.microsoft.com
• Vulners CVE record (CNA data) vulners.com
• Vulners MSCVE record vulners.com
• OpenCVE app.opencve.io
• Positive Technologies advisory listing vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 04:36.