Microsoft Windows: Information disclosure in RPC Runtime

Summary

The RPC Runtime component of Microsoft Windows uses an uninitialized resource, which can lead to the disclosure of information. A remote attacker can send crafted RPC requests over the network to read sensitive data; the impact is limited to confidentiality. Affected are Windows 10, Windows 11, Windows Server 2012, 2012 R2 and 2016 builds listed by Microsoft. The sources disagree on the CVSS score (7.5 in the input, 6.5 in the research notes), and the score has not been verified.

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9612)
• Windows Server 2016 (builds before 10.0.14393.9612)
• Windows 10 Version 1809 (builds before 10.0.17763.9376)
• Windows 10 21H2 and 22H2 (builds before 10.0.19044.7807 and 10.0.19045.7807)
• Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 (builds listed in the Microsoft CNA record)
• Windows Server 2012 and 2012 R2 (builds before 6.2.9200.26434 and 6.3.9600.23470)

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.9376
• Windows 10 21H2: 10.0.19044.7807
• Windows 10 22H2: 10.0.19045.7807
• Windows 11 23H2: 10.0.22631.7652
• Windows 11 24H2: 10.0.26100.9711
• Windows 11 25H2: 10.0.26200.9711
• Windows 11 26H1: 10.0.28000.3231
• Windows 11 26H2: 10.0.26300.9711
• Windows Server 2012 and 2012 R2: 6.2.9200.26434 and 6.3.9600.23470
• KB numbers: Unknown. See the Microsoft Security Update Guide.

Workaround

• No vendor workaround identified in the sources reviewed. Check the FAQ section of the Microsoft Security Update Guide page.
• Restrict RPC and SMB access to internal networks at the firewall.
• Do not expose affected hosts directly to the internet.

Exploitation

• Not publicly disclosed and not known to be exploited, according to Microsoft and the research notes.
• CISA SSVC assessment: exploitation none, not automatable, partial technical impact.
• Not listed in the CISA KEV catalogue according to third-party data (not verified).

Our recommendation

• Identify all hosts running the affected builds, including Windows 10 Version 1607 and Windows Server 2016.
• Install the October 2026 security update within the normal patch cycle, and sooner for internet-facing or segment-crossing RPC servers.
• Windows 10 Version 1607 is out of support: replace or upgrade it, as patching alone may not be sufficient.
• Restrict RPC access to internal networks and monitor event logs for unusual RPC activity.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83515 msrc.microsoft.com
• OpenCVE: CVE-2026-83515 app.opencve.io
• Vulners: CVELIST CVE-2026-83515 (CNA record copy) vulners.com
• Vulners: MSCVE MS:CVE-2026-83515 (affected ranges) vulners.com
• Vulners: Rapid7 RAPID7:CVE-2026-83515 (EPSS data) vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 18:54.