Windows System Information Console: Remote code execution via heap overflow

Summary

A heap-based buffer overflow (CWE-122) in the Windows System Information Console allows an unauthenticated attacker to execute code remotely over the network. The CVSS 3.1 base score is 9.8 (critical), with no privileges or user interaction required. The exact network service needed to trigger the flaw is not documented in the sources reviewed.

Affected

• Microsoft Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9612)
• Microsoft Windows 10 Version 1809 (before 10.0.17763.9376)
• Microsoft Windows 10 Version 21H2 (before 10.0.19044.7807)
• Microsoft Windows 10 Version 22H2 (before 10.0.19045.7807)
• Microsoft Windows 11 Version 23H2 (before 10.0.22631.7652)
• Microsoft Windows 11 Version 24H2 (before 10.0.26100.9711)
• Microsoft Windows 11 Version 25H2 (before 10.0.26200.9711)
• Microsoft Windows 11 Version 26H1 (before 10.0.28000.3231)
• Microsoft Windows 11 Version 26H2 (before 10.0.26300.9711)
• Microsoft Windows Server 2012 and Server Core (before 6.2.9200.26434)
• Microsoft Windows Server 2012 R2 and Server Core (before 6.3.9600.23470)
• Microsoft Windows Server 2016 (before 10.0.14393.9612)
• Note: Third-party aggregators disagree on the affected list. Verify against the MSRC advisory.

Fixed in

• Windows 10 1607 and Windows Server 2016: build 14393.9612 (October 2026 security update KB5126868)
• Latest Windows 10 1607 build: 14393.9615 (out-of-band update KB5134123, October 26, 2026). It is not stated whether this build is required for the full fix.
• Other versions: install the October 2026 security update for your edition, which provides the fixed build listed by Microsoft.

Workaround

• No vendor workaround known. Applying the security update is the fix.
• Restrict network access to affected hosts until they are patched.

Exploitation

• No exploitation in the wild reported.
• CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
• Rapid7 rates it Exploitation Less Likely. EPSS is below 1 percent.
• No public proof of concept found in the research. This does not rule out that one exists.

Our recommendation

• Inventory all Windows 10 1607 and Windows Server 2016 hosts.
• Install KB5126868 and, where possible, the latest out-of-band build KB5134123.
• Restrict inbound network access to affected systems and do not expose them to the internet.
• Plan migration of Windows 10 1607 systems now, as this version has reached end of updates and will receive no further fixes.
• Check the MSRC advisory for the final list of affected products and any mitigation notes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-70157 msrc.microsoft.com
• KB5126868: Windows 10 1607 security update (October 2026) support.microsoft.com
• KB5134123: Windows 10 1607 update (October 2026, out-of-band) support.microsoft.com
• Windows 10 1607 and Windows Server 2016 release health status learn.microsoft.com
• Windows release information learn.microsoft.com
• Rapid7: Patch Tuesday October 2026 www.rapid7.com
• OpenCVE: CVE-2026-70157 app.opencve.io
• VulDB: CVE-2026-70157 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:45.