Microsoft IIS: Remote code execution via stack-based buffer overflow

Summary

Windows Internet Information Services (IIS) contains a stack-based buffer overflow that allows an unauthenticated attacker to execute code remotely over the network. The CVSS 3.1 base score is 9.8 (Critical), with no privileges or user interaction required. Internet-facing IIS servers are the highest priority, while internal servers remain exposed to attackers who already have network access.

Affected

• Windows Server 2016 (build 10.0.14393.0 before 10.0.14393.9612)
• Windows Server 2012 and 2012 R2 (Server Core included), builds before 6.2.9200.26434 and 6.3.9600.23470
• Windows 10 Version 1809, 21H2, 22H2 and Windows 11 Versions 23H2, 24H2, 25H2, 26H1 and 26H2 (builds listed in the official CVE record)
• Windows 10 Version 1607 (as stated in the supplied CPE data): not listed in the official CVE record; the client edition is unverified

Fixed in

• Windows Server 2016: 10.0.14393.9612 or later
• Windows Server 2012: 6.2.9200.26434 or later
• Windows Server 2012 R2: 6.3.9600.23470 or later
• Windows 10 1809: 10.0.17763.9376 or later
• Windows 10 21H2 and 22H2: 10.0.19044.7807 / 10.0.19045.7807 or later
• Windows 11 23H2: 10.0.22631.7652 or later
• Windows 11 24H2 and 25H2: 10.0.26100.9711 / 10.0.26200.9711 or later
• Windows 10 1607 (client): Unknown. Check the MSRC advisory for the client fix.

Workaround

Unknown. No workaround or mitigation is documented in the sources reviewed.

Exploitation

• No public proof of concept found in the sources reviewed.
• No known exploitation in the wild found in the sources reviewed.
• CISA SSVC data in the record: Exploitation none, Automatable yes, Technical Impact total.
• CISA KEV listing: not found; verify in the catalog.
• EPSS score 0.0078 (secondary source).

Our recommendation

• Patch all affected Windows and Windows Server systems with IIS using the Microsoft update for CVE-2026-70024, starting with internet-facing servers.
• Verify the build numbers of every system against the MSRC advisory, including Windows 10 1607 systems.
• Inventory all Windows systems with the IIS role or feature enabled.
• If a system cannot be patched promptly, restrict its network exposure and document the risk with an expiry date.
• Monitor IIS logs and servers for unusual requests and unexpected processes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-70024 msrc.microsoft.com
• NVD record via vulners mirror vulners.com
• OpenCVE: CVE-2026-70024 app.opencve.io
• VulDB: CVE-2026-70024 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:48.