Microsoft Windows iSCSI: Heap-based buffer overflow enables denial of service

Summary

A heap-based buffer overflow in the Windows iSCSI component can be triggered over the network. An unauthenticated remote attacker can crash the affected service or host, causing a denial of service. Data confidentiality and integrity are not affected according to the CVSS vector, and no user interaction is required.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to below 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to below 10.0.17763.9376)
• Windows 10 Version 21H2 and 22H2 (10.0.19044.0 and 10.0.19045.0 to below 10.0.19044.7807 and 10.0.19045.7807)
• Windows 11 Versions 23H2, 24H2, 25H2 and 26H2, and 26H1
• Windows Server 2012 and 2012 R2 (including Server Core)
• Windows Server 2016

Fixed in

• Windows 10 Version 1607: build 10.0.14393.9612 (per CNA data; Wikipedia lists 14393.9615, unresolved)
• Windows 10 Version 1809: build 10.0.17763.9376
• Windows 10 21H2 and 22H2: build 10.0.19044.7807 and 10.0.19045.7807
• Windows 11 23H2: build 10.0.22631.7652
• Windows 11 24H2, 25H2 and 26H2: build 10.0.26100.9711, 10.0.26200.9711 and 10.0.26300.9711
• Windows 11 26H1: build 10.0.28000.3231
• Windows Server 2012 and 2012 R2: builds 6.2.9200.26434 and 6.3.9600.23470
• Confirm fixed builds on the MSRC advisory. The Microsoft update KB5126868 (October 2026) carries build 14393.9612.
• Windows 10 Enterprise LTSB 2016 (1607) reached end of updates on 13 October 2026. A fix may not be available unless Extended Security Updates apply; this is unconfirmed.

Workaround

Unknown. Microsoft has not published a workaround in the sources reviewed.

• Unverified: if the iSCSI service is not required, disable or restrict it. This is not from the MSRC advisory and must be confirmed there.
• General hardening: restrict access to the iSCSI port (TCP 3260) to the storage network only.

Exploitation

• Exploitation in the wild: none known. CISA SSVC lists exploitation as 'none', automatable as 'yes' and technical impact as 'partial'.
• EPSS about 0.013 (as of 31 October 2026).
• No public proof of concept found in the sources reviewed; this does not prove none exists.

Our recommendation

• Check whether Windows 10 1607 or Windows Server 2016 systems with iSCSI are in use, especially kiosks, POS terminals, thin clients and HMIs.
• Migrate 1607 systems to a supported Windows version; if a fix is required, check Extended Security Updates eligibility with Microsoft or your licensing partner.
• Apply the October 2026 security update to supported systems after verifying the fixed build on the MSRC page. Test KB5126868 first, as the release-health page notes a mitigated Exchange OWA/email issue after installation.
• Limit TCP 3260 to the storage network and monitor for service crashes or unexpected iSCSI traffic.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-70031 msrc.microsoft.com
• Microsoft release health: Windows 10 1607 and Windows Server 2016 learn.microsoft.com
• NVD record via Vulners vulners.com
• OpenCVE record (SSVC data) app.opencve.io
• Strix CVE record www.strix.ai
• VulDB entry 418328 vuldb.com
• 4sysops: Windows 10 Enterprise LTSB 2016 end of support and ESU 4sysops.com
• Windows Server 2016 (Wikipedia) en.wikipedia.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 19:11.