Microsoft Windows: Heap-based buffer overflow in HID Parser Library

Summary

A heap-based buffer overflow in the Windows HID Parser Library allows an authorized local attacker to elevate privileges. The attacker needs a low-privileged account on the affected machine, so this is a privilege escalation step rather than a remote entry point. Microsoft rates the issue Important (CVSS 3.1 base score 7.8), and CISA SSVC data lists no known exploitation.

Affected

• Windows 10 Version 1809 (x64 and 32-bit), before 10.0.17763.9376
• Windows Server 2019 and Server 2019 (Server Core), before 10.0.17763.9376
• Windows 10 Version 21H2, before 10.0.19044.7807
• Windows 10 Version 22H2, before 10.0.19045.7807
• Windows 11 Version 23H2, before 10.0.22631.7652
• Windows 11 Version 24H2, before 10.0.26100.9711
• Windows 11 Version 25H2, before 10.0.26200.9711
• Windows 11 Version 26H1, before 10.0.28000.3231
• Windows 11 Version 26H2, before 10.0.26300.9711
• Windows Server 2022, before 10.0.20348.5761
• Windows Server 2025 and Server 2025 (Server Core), before 10.0.26100.33650

Fixed in

• Install the October 2026 security update for each affected branch (Microsoft's advisory is the authority).
• Windows 10 1809 / Server 2019: build 10.0.17763.9376 or later, reported by third-party mirrors; verify on the MSRC page before deployment.
• Other branches: build numbers as listed under Affected.

Workaround

Unknown.

Exploitation

• No evidence of exploitation in the wild.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• Microsoft temporal vector E:U (exploit code maturity unproven).
• EPSS is about 0.0037. No public proof of concept found in our searches.

Our recommendation

• Patch affected Windows systems in the October 2026 update cycle, starting with multi-user systems, terminal servers, and kiosks.
• Confirm the installed build number on each host after patching.
• Check the support status of Windows 10 1809 hosts; consumer and older editions are out of support.
• Limit local accounts and restrict untrusted USB devices where possible.
• No emergency action is indicated by the current data.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-83569 msrc.microsoft.com
• NVD entry via Vulners vulners.com
• OpenCVE record CVE-2026-83569 app.opencve.io
• Microsoft advisory mirror via Vulners vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 03:38.