Microsoft Windows IIS: Heap-based buffer overflow allows local privilege escalation
Summary
A heap-based buffer overflow in Microsoft Windows Internet Information Services (IIS) allows an authorized local attacker to elevate privileges. The attacker needs valid low-privilege access to the system, for example through a compromised user account or malware. A successful attack can lead to full compromise of confidentiality, integrity and availability on the affected host. The vulnerability is not remotely exploitable by itself.
Affected
- Windows 10 Version 1607 (builds before 10.0.14393.9612)
- Windows 10 Version 1809 (builds before 10.0.17763.9376)
- Windows 10 Version 21H2 (builds before 10.0.19044.7807)
- Windows 10 Version 22H2 (builds before 10.0.19045.7807)
- Windows 11 Version 23H2 (builds before 10.0.22631.7652)
- Windows 11 Version 24H2 (builds before 10.0.26100.9711)
- Windows 11 Version 25H2 and 26H2 (builds before 10.0.26200.9711 and 10.0.26300.9711)
- Windows 11 Version 26H1 (builds before 10.0.28000.3231)
- Windows Server 2012 and 2012 R2 (builds before 6.2.9200.26434 and 6.3.9600.23470)
- Windows Server 2016 (builds before 10.0.14393.9612)
- Note: The CPE in the input lists only Windows 10 1607; the CVE record covers the products above.
Fixed in
- Install the October 2026 security updates from Microsoft.
- Windows 10 1607 / Windows Server 2016: 10.0.14393.9612
- Windows 10 1809 / Server 2019: 10.0.17763.9376 (KB5126651 according to a third-party listing)
- Windows 10 21H2: 10.0.19044.7807
- Windows 10 22H2: 10.0.19045.7807
- Windows 11 23H2: 10.0.22631.7652 (not verified with MSRC)
- Windows 11 24H2: 10.0.26100.9711 (not verified with MSRC)
- The KB number for Windows 10 1607 is unknown; check the MSRC update guide.
Workaround
Unknown. No workaround or mitigation was found in the sources. Installing the update is the recommended fix.
Exploitation
- Not known to be exploited in the wild.
- Not listed in the CISA KEV catalog.
- CISA SSVC: exploitation none, not automatable, total technical impact.
- EPSS score: 0.00364 (very low).
- No public proof of concept found; this does not prove that none exists.
Our recommendation
- Install the October 2026 security updates on all affected Windows systems, prioritizing servers with IIS and multi-user systems.
- Check whether any Windows 10 1607 systems are still in use; this version is no longer serviced in most editions, so confirm patch availability for your edition or retire the system.
- Limit local accounts and restrict logon rights on servers running IIS.
- Monitor for unusual local privilege escalation activity on hosts that run IIS.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows Internet Information Services
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126651, KB5126655, KB5126657, KB5126646, KB5127648, KB5126653
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-78459 msrc.microsoft.com
- OpenCVE: CVE-2026-78459 app.opencve.io
- Vulners: CVE-2026-78459 vulners.com
- Strix: CVE-2026-78459 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 03:44.
Original description (NVD)
Heap-based buffer overflow in Windows Internet Information Services allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.