Windows 10 1607: Heap-based buffer overflow in Rich Text Edit Control
Summary
A heap-based buffer overflow in the Windows Rich Text Edit Control allows a locally authorized user with low privileges to elevate privileges on the affected system. Successful exploitation can lead to code execution with higher privileges. The attacker needs local access and an existing foothold, such as a logged-in user or malware running as a user, so the risk is not direct internet exposure.
Affected
- Windows 10 Version 1607 (10.0.14393.0 to below 10.0.14393.9612)
- Windows Server 2016 (10.0.14393.0 to below 10.0.14393.9612)
- Other affected versions per the CNA record: Windows 10 1809, 21H2, 22H2, Windows 11 23H2, 24H2, 25H2, 26H1, 26H2, Windows Server 2012 and 2012 R2
Fixed in
- Windows 10 Version 1607: 10.0.14393.9612 or later (KB number unknown)
- Windows 10 1809: 10.0.17763.9376 or later
- Windows 10 21H2 and 22H2: 10.0.19045.7807 or later (21H2: 10.0.19044.7807)
- Windows 11 23H2: 10.0.22631.7652 or later
- Windows 11 24H2 and 25H2: 10.0.26100.9711 or later
- Windows 11 26H1: 10.0.28000.3231 or later
- Windows 11 26H2: 10.0.26300.9711 or later
- Windows Server 2012 and 2012 R2: see the MSRC advisory for the fixed builds
Workaround
Unknown. No vendor or third-party workaround was found. Installing the security update is the recommended remedy.
Exploitation
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total
- Not listed in CISA KEV
- No public proof of concept known
Our recommendation
- Install the October 2026 security update on all affected Windows systems, starting with shared or multi-user machines such as terminal or file servers.
- Check the MSRC advisory for the KB numbers and confirm the build number after patching.
- Restrict local logons and remove unnecessary local user accounts.
- Windows 10 Version 1607 is an old release; plan an upgrade to a supported version.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows Rich Text Edit Control
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5127648, KB5126651, KB5126655, KB5126657, KB5126646, KB5126653
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-70093 msrc.microsoft.com
- NVD record via Vulners: CVE-2026-70093 vulners.com
- CVE record via Vulners CVELIST: CVE-2026-70093 vulners.com
- OpenCVE: CVE-2026-70093 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 04:17.
Original description (NVD)
Heap-based buffer overflow in Windows Rich Text Edit Control allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.