Windows PowerShell: Integer overflow allowing local code execution

Summary

An integer overflow (CWE-190) with a possible heap-based buffer overflow (CWE-122) in Windows PowerShell affects Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 as well as Windows Server 2022 and 2025. An authorized local user with low privileges can execute code with high impact on confidentiality, integrity and availability. The attack requires local access and no user interaction, so the risk is mainly for compromised accounts, malicious insiders or malware already running on a machine. Microsoft's title refers to remote code execution, but the CVSS vector is local (AV:L), so the local vector is authoritative.

Affected

• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9711
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5761
• Windows Server 2025 (including Server Core): 10.0.26100.0 to before 10.0.26100.33650

Fixed in

• Windows 11 Version 23H2: 10.0.22631.7652 or later
• Windows 11 Version 24H2: 10.0.26100.9711 or later
• Windows 11 Version 25H2: 10.0.26200.9711 or later
• Windows 11 Version 26H1: 10.0.28000.3231 or later
• Windows 11 Version 26H2: 10.0.26300.9711 or later
• Windows Server 2022: 10.0.20348.5761 or later
• Windows Server 2025: 10.0.26100.33650 or later

Fix version data is taken from the CNA record and should be verified against the MSRC advisory.

Workaround

Unknown. Microsoft has not published a workaround. Installing the October 2026 cumulative update is the fix.

• Defence-in-depth only, not from Microsoft: restrict script execution with a restrictive execution policy and block unauthorized scripts with AppLocker or Windows Defender Exploit Guard.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total.
• Not listed in the CISA KEV catalogue according to the research notes.
• VulDB states that no exploit exists.
• No public proof of concept or in-the-wild exploitation found in the research. This is not proof of absence.

Our recommendation

• Install the October 2026 cumulative update on all affected Windows 11 and Windows Server systems, starting with shared admin workstations and terminal servers.
• Until patched, restrict PowerShell script execution with policy and AppLocker where operationally possible.
• Review local accounts and privileges, and limit administrative rights to what is needed.
• Monitor PowerShell logging (script block logging) for unusual local script execution.
• Verify the fixed build numbers against the MSRC advisory before rollout.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-70052 msrc.microsoft.com
• NVD-mirrored CVE data (OpenCVE) app.opencve.io
• Affected builds (Strix) www.strix.ai
• VulDB entry vuldb.com
• NVD record mirror (Vulners) vulners.com
• CNA record mirror (Vulners) vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 04:31.