Microsoft Windows: Heap-based buffer overflow in Client-Side Caching (CSC) Service

Summary

A heap-based buffer overflow in the Windows Client-Side Caching (CSC) Service allows an authorized local user to elevate privileges. Exploitation requires local code execution or an existing local foothold, and the attack complexity is high. Microsoft rates the flaw as Important with a CVSS 3.1 base score of 7.0, and no public exploitation is known.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to < 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 to < 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to < 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to < 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to < 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to < 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to < 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to < 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to < 10.0.26300.9711
• Windows Server 2012 and 2012 R2 (including Server Core): 6.2.9200.0 to < 6.2.9200.26434 and 6.3.9600.0 to < 6.3.9600.23470
• Windows Server 2016: 10.0.14393.0 to < 10.0.14393.9612

Fixed in

• Windows 10 1607 and Windows Server 2016: 10.0.14393.9612
• Windows 10 1809 / Server 2019: 10.0.17763.9376
• Windows 10 22H2: 10.0.19045.7807
• Windows Server 2012: 6.2.9200.26434; Windows Server 2012 R2: 6.3.9600.23470
• Windows 11 23H2: 10.0.22631.7652
• Windows 11 24H2: 10.0.26100.9711; Windows Server 2025: 10.0.26100.33650
• Windows 11 25H2: 10.0.26200.9711
• Windows 11 26H1: 10.0.28000.3231
• Windows 11 26H2: 10.0.26300.9711

Workaround

Unknown. No vendor-documented interim mitigation is available; install the security update.

Exploitation

• Microsoft exploitability assessment: not publicly disclosed, not exploited.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• No CISA KEV listing and no public proof of concept found. EPSS is about 0.3 percent.

Our recommendation

• Install the October 2026 security update (released 13 Oct 2026) on all listed Windows systems, starting with shared workstations, terminal servers and file servers that use CSC.
• Replace or upgrade Windows 10 1607 systems, which are end of life.
• Verify exact build numbers on the MSRC page before rollout.
• Restrict local logon on shared systems and monitor for unexpected privilege escalation.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83580 msrc.microsoft.com
• MSRC Security Update Guide (en-US) msrc.microsoft.com
• Vulners: Microsoft CVE record MS:CVE-2026-83580 vulners.com
• Vulners: NVD record NVD:CVE-2026-83580 vulners.com
• OpenCVE: CVE-2026-83580 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:43.