Windows OLE: Heap-based buffer overflow enables local privilege escalation

Summary

A heap-based buffer overflow in the Windows OLE component allows an attacker with a local, low-privilege account to elevate privileges. Successful exploitation can lead to full control over the affected system (high confidentiality, integrity and availability impact). The attacker must already have local code execution or a logged-in user account, so this is a follow-on step after an initial compromise.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to < 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to < 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to < 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to < 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to < 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to < 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to < 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to < 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to < 10.0.26300.9711)
• Windows Server 2012, including Server Core (6.2.9200.0 to < 6.2.9200.26434)
• Windows Server 2012 R2, including Server Core (6.3.9600.0 to < 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 to < 10.0.14393.9612)
• Note: the CPE data in NVD lists only Windows 10 1607; the CNA record covers the list above.

Fixed in

• Fixed builds per CNA record: 10.0.14393.9612 (1607, Server 2016), 10.0.17763.9376 (1809), 10.0.19044.7807 (21H2), 10.0.19045.7807 (22H2), 10.0.22631.7652 (23H2), 10.0.26100.9711 (24H2), 10.0.26200.9711 (25H2), 10.0.28000.3231 (26H1), 10.0.26300.9711 (26H2), 6.2.9200.26434 (Server 2012), 6.3.9600.23470 (Server 2012 R2).
• KB numbers reported by a secondary source (not yet verified on MSRC): KB5126651 for Windows 10 1809 and Server 2019; KB5126646 for Windows Server 2025.
• Unknown: KB number for Windows 10 1607 and LTSB 2016.

Workaround

Unknown.

Third-party summary (not vendor guidance): disable or restrict OLE automation via Group Policy for users who do not need it, and enforce least privilege for local accounts.

Exploitation

• No known exploitation in the wild in the reviewed sources. The CISA KEV catalogue was not checked directly.
• No public proof-of-concept found.
• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• EPSS about 0.3 percent (very low).

Our recommendation

• Install the October 2026 Microsoft security update on all affected Windows systems, starting with multi-user systems, Remote Desktop and terminal servers.
• Confirm on the MSRC advisory the correct KB numbers and builds, especially for Windows 10 1607 and LTSB 2016.
• Check whether your Windows 10 1607 devices still receive security updates and plan an upgrade if they do not.
• Restrict local logon and limit local administrator rights; review accounts for phishing or malware exposure.
• Where OLE automation is not needed, restrict it via Group Policy after testing.
• Monitor for privilege escalation indicators on endpoints and servers.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-70059 msrc.microsoft.com
• CVE List record (Vulners) vulners.com
• NVD record (Vulners) vulners.com
• OpenCVE summary app.opencve.io
• VulDB entry vuldb.com
• Strix AI CVE summary (affected builds, unverified) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 04:27.