Windows 11: Heap-based buffer overflow in Windows Kernel (privilege escalation)

Summary

A heap-based buffer overflow in the Windows kernel allows a local attacker with low privileges to elevate their rights to system level. Exploitation requires an existing local foothold, such as a logged-in user account or malware already running on the device, and the vulnerability is not reachable from the internet by itself. Microsoft rates the impact as high for confidentiality, integrity and availability.

Affected

• Windows 11 version 23H2: 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 version 24H2: 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 version 25H2: 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 version 26H1: 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 version 26H2: 10.0.26300.0 to before 10.0.26300.9711
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5761
• Windows Server 2025 (including Server Core): 10.0.26100.0 to before 10.0.26100.33650

Fixed in

• Windows 11 version 23H2: 10.0.22631.7652 or later
• Windows 11 version 24H2 and 25H2: 10.0.26100.9711 and 10.0.26200.9711 or later
• Windows 11 version 26H1: 10.0.28000.3231 or later
• Windows 11 version 26H2: 10.0.26300.9711 or later
• Windows Server 2022: 10.0.20348.5761 or later
• Windows Server 2025: 10.0.26100.33650 or later
• Security update from Microsoft (October 2026); KB number not confirmed, see MSRC

Workaround

No workaround is documented for installed systems. Apply the security update.

• Only as an interim measure for systems that cannot be patched yet: restrict privileged accounts and limit local access to the affected devices.

Exploitation

• Microsoft rates exploit code maturity as "Unproven".
• EPSS score is very low (0.00341).
• No reports of exploitation were found. The CISA Known Exploited Vulnerabilities catalog was not checked, so this is unverified.
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Install the October 2026 security update on all affected Windows 11 and Windows Server systems as part of the regular monthly patch cycle, and prioritise shared and privileged machines.
• Check Windows 11 23H2 systems for the correct build number after patching.
• Restrict local logons on shared PCs and terminal servers, and limit administrative rights.
• Verify the end of servicing for Windows 11 23H2 on Microsoft's lifecycle page and plan the move to 24H2 or 25H2 if support ends soon.
• Monitor endpoints for privilege escalation attempts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-70114 msrc.microsoft.com
• Vulners: CVE-2026-70114 (CVE list record) vulners.com
• Vulners: MS:CVE-2026-70114 (Microsoft mirror) vulners.com
• Vulners: NVD:CVE-2026-70114 (NVD mirror) vulners.com
• OpenCVE: CVE-2026-70114 app.opencve.io
• Strix: CVE-2026-70114 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 04:12.