Windows Search Component: Numeric truncation allows local privilege escalation

Summary

A numeric truncation error (CWE-197, CWE-20) in the Windows Search Component allows an authorized local user to elevate privileges. The attacker needs valid low-privileged access to the system and no user interaction is required. According to the CVSS 3.1 record, a successful attack would give full control over confidentiality, integrity and availability (7.8, High).

Affected

• Windows 10 Version 1607: 10.0.14393.0 to below 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 to below 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to below 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to below 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to below 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to below 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to below 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to below 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to below 10.0.26300.9711
• Windows Server 2012 and 2012 R2 (incl. Server Core): 6.2.9200.0 to below 6.2.9200.26434 and 6.3.9600.0 to below 6.3.9600.23470
• Windows Server 2016: 10.0.14393.0 to below 10.0.14393.9612

Note: The CPE in the CVE record lists only Windows 10 1607, but the official record lists the wider range above.

Fixed in

• Fixed builds according to third-party aggregators, not yet confirmed against the MSRC table: Windows 10 1607 and Server 2016 10.0.14393.9612; Windows 10 1809 10.0.17763.9376; Windows 10 21H2 10.0.19044.7807; Windows 10 22H2 10.0.19045.7807; Windows 11 23H2 10.0.22631.7652; Windows 11 24H2 10.0.26100.9711; Windows 11 25H2 10.0.26200.9711; Windows 11 26H2 10.0.26300.9711; Windows Server 2025 10.0.26100.33650; Windows Server 2012 R2 6.3.9600.23470; Windows Server 2012 6.2.9200.26434.
• Patch numbers reported by Tenable Nessus: KB5126646 (Windows Server 2025), KB5126651 (Windows 10 1809 and Server 2019). KB numbers for 1607 and other builds: unknown.

Workaround

Unknown. No vendor workaround found. The fix is the security update for the affected build.

Exploitation

• No evidence of exploitation in the wild in the sources reviewed.
• Not listed in the CISA KEV catalog; no public proof of concept found.
• CISA SSVC: exploitation none, not automatable, total technical impact.
• EPSS score is low (about 0.003).
• A VulDB market estimate of USD 5,000 to 25,000 for an exploit is not evidence of exploitation.

Our recommendation

• Install the October 2026 security update on all affected systems and confirm the build numbers against the MSRC Security Update Guide.
• Prioritise multi-user systems, Remote Desktop and terminal servers, and any Windows 10 1607 or 1809 systems.
• Check for unsupported Windows 10 1607 systems and confirm their support status with Microsoft.
• Review local accounts and restrict standard user access where possible.
• Monitor the MSRC page for changes to the exploitation status.
• No action needed for systems that are not affected or already patched, but verify the patch level.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide (CVE-2026-70177) msrc.microsoft.com
• Microsoft Security Update Guide, EN-US msrc.microsoft.com
• NVD record via Vulners vulners.com
• MSCVE entry via Vulners vulners.com
• VulDB entry CVE-2026-70177 vuldb.com
• Strix AI CVE summary www.strix.ai
• Rapid7 entry via Vulners vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 04:03.