Microsoft Windows Smart Card: Local privilege escalation via heap overflow

Summary

The Windows Smart Card component in several Windows 10, Windows 11 and Windows Server versions contains a heap-based buffer overflow (CWE-122). An attacker with local access and a low-privileged account can exploit it to elevate privileges, which may give full control over the affected system. Exploitation requires an existing foothold on the machine; no remote attack vector is indicated. Fixed builds are available for the affected versions, except for Windows Server 2012 and 2012 R2, where no fix is listed.

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9612)
• Windows Server 2016 (builds before 10.0.14393.9612)
• Windows 10 Version 1809 and Windows Server 2019 (builds before 10.0.17763.9376)
• Windows 10 Version 21H2 (builds before 10.0.19044.7807)
• Windows 10 Version 22H2 (builds before 10.0.19045.7807)
• Windows 11 Version 23H2 (builds before 10.0.22631.7652)
• Windows 11 Version 24H2, 25H2 and 26H2 (builds before 10.0.26100.9711, 10.0.26200.9711 and 10.0.26300.9711)
• Windows 11 Version 26H1 (builds before 10.0.28000.3231)
• Windows Server 2022 (builds before 10.0.20348.5761)
• Windows Server 2012 and 2012 R2, including Server Core (listed as affected, fixed version unknown)

Fixed in

• Windows 10 1607 and Windows Server 2016: 10.0.14393.9612
• Windows 10 1809 and Windows Server 2019: 10.0.17763.9376
• Windows 10 21H2: 10.0.19044.7807
• Windows 10 22H2: 10.0.19045.7807
• Windows 11 23H2: 10.0.22631.7652
• Windows 11 24H2 / 25H2 / 26H2: 10.0.26100.9711 / 10.0.26200.9711 / 10.0.26300.9711
• Windows 11 26H1: 10.0.28000.3231
• Windows Server 2022: 10.0.20348.5761
• Windows Server 2012 / 2012 R2: Unknown.
• KB numbers for Windows 10 1607 and 21H2/22H2: Unknown.

Workaround

• No official Microsoft workaround known.
• Disable the Smart Card service on systems that do not need smart-card or certificate-based logon (third-party recommendation).
• Restrict smart-card use to authorized staff.

Exploitation

• No evidence of exploitation in the wild found.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• Not listed in CISA KEV.
• EPSS very low (below 1%).
• No public proof of concept found; public disclosure status unknown.

Our recommendation

• Install the Microsoft security update for your Windows version as soon as possible; check the MSRC advisory for the correct build.
• Check whether Windows 10 1607 is still supported. If it is out of support, no patch may be available and an upgrade is the priority.
• Identify systems that use smart-card or certificate-based logon and patch them first.
• Review local administrator and privileged accounts and monitor for unexpected privilege changes on shared machines.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83579 msrc.microsoft.com
• NVD data via Vulners vulners.com
• OpenCVE: CVE-2026-83579 app.opencve.io
• Strix: CVE-2026-83579 (fixed build discrepancy for Windows 10 22H2) www.strix.ai
• CVE List via Vulners vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 03:36.