Microsoft Windows PowerShell: Remote code execution via integer underflow

Summary

A integer underflow in Windows PowerShell allows an unauthenticated attacker to execute code remotely over the network. The CVSS base score is 9.8 (critical). Exposure matters most: hosts reachable from untrusted networks are at highest risk, while internal-only hosts face lower but still significant lateral-movement risk.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9711
• Windows Server 2012 and Server Core: 6.2.9200.0 to before 6.2.9200.26434
• Windows Server 2012 R2 and Server Core: 6.3.9600.0 to before 6.3.9600.23470
• Windows Server 2016: 10.0.14393.0 to before 10.0.14393.9612
• Note: Whether 32-bit editions of Windows 10 1607 are affected is unknown.

Fixed in

• Install the Microsoft security update released on 13 October 2026 for your Windows version.
• Fixed builds per the official CVE record: 10.0.14393.9612 (1607 and Server 2016), 10.0.17763.9376 (1809), 10.0.19044.7807 (21H2), 10.0.19045.7807 (22H2), 10.0.22631.7652 (23H2), 10.0.26100.9711 (24H2), 10.0.26200.9711 (25H2), 10.0.28000.3231 (26H1), 10.0.26300.9711 (26H2), 6.2.9200.26434 (Server 2012), 6.3.9600.23470 (Server 2012 R2).
• Fixed status for 32-bit Windows 10 1607 is unknown; verify on the MSRC page.

Workaround

Unknown.

• No vendor-listed workaround was found in the sources reviewed.
• The trigger path (which PowerShell service or protocol is reached) is not described in the sources.

Exploitation

• No evidence of exploitation in the wild was found.
• CISA SSVC data records exploitation as none; the CVE is not listed in CISA KEV.
• Microsoft reports the vulnerability as not publicly disclosed and not exploited at original publication.
• No public proof-of-concept exploit was found; absence from search results does not prove none exists.
• EPSS is about 1 percent.

Our recommendation

• Patch affected hosts in the next maintenance window, starting with internet-facing and legacy systems such as Windows 10 1607 and Server 2016.
• Confirm the exact build and support or ESU status for each host on the MSRC page and Microsoft's lifecycle page before relying on the patch.
• Restrict inbound access to PowerShell remoting (WinRM) to management networks.
• Identify any affected hosts reachable from the internet or untrusted networks and prioritise them.
• Monitor for unusual PowerShell or WinRM activity.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC advisory CVE-2026-83578 msrc.microsoft.com
• Vulners (MSCVE) CVE-2026-83578 vulners.com
• Vulners (NVD) CVE-2026-83578 vulners.com
• OpenCVE CVE-2026-83578 app.opencve.io
• cvefeed.io CVE-2026-83578 cvefeed.io
• Strix CVE-2026-83578 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:37.