Windows Client-Side Caching: Heap-based buffer overflow allows privilege escalation

Summary

A heap-based buffer overflow in the Windows Client-Side Caching (CSC) service allows an unauthorized attacker to elevate privileges over a network. The CVSS 3.1 base score is 8.8 (High), with network access and no privileges required, but user interaction is needed. Microsoft's CISA SSVC assessment rates technical impact as total, while exploitation is rated none.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to below 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to below 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to below 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to below 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to below 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to below 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to below 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to below 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to below 10.0.26300.9711)
• Windows Server 2012 (6.2.9200.0 to below 6.2.9200.26434), including Server Core
• Windows Server 2012 R2 (6.3.9600.0 to below 6.3.9600.23470), including Server Core
• Windows Server 2016 (10.0.14393.0 to below 10.0.14393.9612)

Fixed in

• Windows 10 Version 1607: 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.9376
• Windows 10 Version 21H2 and 22H2: 10.0.19044.7807 and 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.7652
• Windows 11 Version 24H2, 25H2 and 26H2: 10.0.26100.9711, 10.0.26200.9711 and 10.0.26300.9711
• Windows 11 Version 26H1: 10.0.28000.3231
• Windows Server 2012: 6.2.9200.26434
• Windows Server 2012 R2: 6.3.9600.23470
• Windows Server 2016: 10.0.14393.9612
• Install the Microsoft security update for CVE-2026-70068 from the Security Update Guide; confirm the matching KB article for each build.

Workaround

• Unknown from the official sources.
• Third-party notes suggest restricting inbound traffic to the CSC service or disabling the service. This could not be verified, so check the MSRC advisory before relying on it.

Exploitation

• No evidence of exploitation in the wild found in the sources.
• Not listed in CISA KEV at the time of research.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• EPSS below 1 percent.
• No public proof of concept found in the sources; this does not rule one out.

Our recommendation

• Inventory all Windows 10, Windows 11 and Windows Server systems and check whether the Client-Side Caching service is running and reachable.
• Install the October 2026 security update on all affected builds in the next patch cycle, prioritizing older systems.
• Check whether Windows 10 Version 1607 or Windows Server 2012 still receive vendor updates; if not, isolate or replace these systems.
• Monitor for unusual privilege changes on endpoints until patching is complete.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-70068 msrc.microsoft.com
• Vulners NVD record CVE-2026-70068 vulners.com
• Vulners MSRC-derived listing CVE-2026-70068 vulners.com
• OpenCVE CVE-2026-70068 app.opencve.io
• SonicWall coverage of Microsoft October 2026 security bulletin www.sonicwall.com
• Strix CVE-2026-70068 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:58.