Microsoft Windows NTFS: Elevation of privilege via out-of-bounds read

Summary

Windows NTFS, the default file system of Windows, contains an out-of-bounds read (CWE-125) that allows an authorized local user to elevate privileges. An attacker needs a local, low-privileged logon and can then gain higher privileges, potentially up to SYSTEM, with high impact on confidentiality, integrity and availability. The vulnerability is not reachable from the internet, but it matters after a compromise, for example when a phished user or malware on one workstation tries to take over the system.

Affected

• Microsoft Windows 10 Version 1607 (10.0.14393.0 to below 10.0.14393.9612)
• Microsoft Windows 10 Version 1809 (10.0.17763.0 to below 10.0.17763.9376)
• Microsoft Windows 10 Version 21H2 (10.0.19044.0 to below 10.0.19044.7807)
• Microsoft Windows 10 Version 22H2 (10.0.19045.0 to below 10.0.19045.7807)
• Microsoft Windows 11 Version 23H2 (10.0.22631.0 to below 10.0.22631.7652)
• Microsoft Windows 11 Version 24H2 (10.0.26100.0 to below 10.0.26100.9711)
• Microsoft Windows 11 Version 25H2 (10.0.26200.0 to below 10.0.26200.9711)
• Microsoft Windows 11 Version 26H1 (10.0.28000.0 to below 10.0.28000.3231)
• Microsoft Windows 11 Version 26H2 (10.0.26300.0 to below 10.0.26300.9711)
• Microsoft Windows Server 2012 incl. Server Core (6.2.9200.0 to below 6.2.9200.26434)
• Microsoft Windows Server 2012 R2 incl. Server Core (6.3.9600.0 to below 6.3.9600.23470)
• Microsoft Windows Server 2016 (10.0.14393.0 to below 10.0.14393.9612)
• Note: the NVD CPE lists only Windows 10 1607; the CNA record is broader.

Fixed in

• Windows 10 1607 and Server 2016: build 10.0.14393.9612
• Windows 10 1809: build 10.0.17763.9376
• Windows 10 21H2: build 10.0.19044.7807
• Windows 10 22H2: build 10.0.19045.7807
• Windows 11 23H2: build 10.0.22631.7652
• Windows 11 24H2, 25H2 and 26H2: build 10.0.26100.9711 / 10.0.26200.9711 / 10.0.26300.9711
• Windows 11 26H1: build 10.0.28000.3231
• Windows Server 2012: build 6.2.9200.26434
• Windows Server 2012 R2: build 6.3.9600.23470
• Source: CNA record; verify on MSRC. KB numbers: Unknown.

Workaround

Unknown. No workaround has been published in the sources reviewed; the security update is the fix.

Exploitation

• Exploitation in the wild: no evidence found.
• Public proof-of-concept: none found.
• EPSS: 0.00388 (low predicted exploitation probability).
• CISA SSVC: exploitation none, automatable no, technical impact total.
• Microsoft's exploitability flag: unknown; not retrieved.

Our recommendation

• Install the October 2026 Windows security update on all affected systems, including Windows 10 1607 and Server 2016, after confirming the KB number on MSRC.
• Check the support status of Windows 10 1607 and other old builds; replace unsupported systems, especially legacy or production machines.
• Prioritise hosts with shared or multi-user logons, RDP access or weak local privilege separation.
• Enforce least privilege for local accounts, limit local logons to servers, and keep EDR active.
• Monitor for unusual privilege escalation on endpoints and servers.
• Do not confuse this CVE with CVE-2026-69265, which carries the same description text.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83567 msrc.microsoft.com
• Vulners NVD record CVE-2026-83567 vulners.com
• Strix CVE-2026-83567 www.strix.ai
• OpenCVE CVE-2026-83567 app.opencve.io
• Qualys Patch Tuesday October 2026 review threatprotect.qualys.com
• Windows Forum: CVE-2026-69265 (same description, for comparison) windowsforum.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 03:37.