Windows Kernel-Mode Drivers: Out-of-bounds read enables local privilege escalation
Summary
An out-of-bounds read in the Windows Kernel-Mode Drivers allows an authorized local user to elevate privileges. Several supported Windows 10, Windows 11 and Windows Server versions are affected. An attacker needs a valid low-privileged account on the system, and no user interaction is required. The flaw is not directly reachable from the internet, but it can turn a compromised user account into full system control. Microsoft rates it as Important.
Affected
- Windows 10 Version 1607 (below 10.0.14393.9612)
- Windows 10 Version 1809 (below 10.0.17763.9376)
- Windows 10 Version 21H2 (below 10.0.19044.7807)
- Windows 10 Version 22H2 (below 10.0.19045.7807)
- Windows 11 Version 23H2 (below 10.0.22631.7652)
- Windows Server 2012 (below 6.2.9200.26434), including Server Core
- Windows Server 2012 R2 (below 6.3.9600.23470), including Server Core
- Windows Server 2016 (below 10.0.14393.9612), including Server Core
- Windows Server 2019 (below 10.0.17763.9376), including Server Core
- Windows Server 2022 (below 10.0.20348.5761)
Fixed in
- Fixed in the Microsoft update of October 13, 2026.
- Fixed builds per the CNA record: 10.0.14393.9612 (1607, Server 2016), 10.0.17763.9376 (1809, Server 2019), 10.0.19044.7807 (21H2), 10.0.19045.7807 (22H2), 10.0.22631.7652 (Windows 11 23H2), 6.2.9200.26434 (Server 2012), 6.3.9600.23470 (Server 2012 R2), 10.0.20348.5761 (Server 2022).
- The KB article numbers are unknown; confirm them on the MSRC page.
Workaround
Unknown.
Exploitation
- No public exploit code found.
- No known exploitation in the wild.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- Microsoft's exploit maturity field is reported as not exploited, but this was not confirmed on the live MSRC page.
Our recommendation
- Install the October 2026 security update on all affected systems, prioritising shared machines, Remote Desktop and terminal servers, and Server 2016 hosts.
- Check the MSRC advisory for the exact KB numbers and confirm the fixed builds before patching.
- Verify the support status of Windows 10 1607 in the Microsoft lifecycle pages; out-of-support systems receive no fix and need to be upgraded.
- Review local accounts and restrict unnecessary local logons.
- Monitor the CISA KEV catalog for changes in exploitation status.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows Kernel-Mode Drivers
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126651, KB5126655, KB5126657, KB5126646, KB5126653, KB5126868
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Response Center: CVE-2026-83637 msrc.microsoft.com
- CNA record mirror (Vulners, CVE List) vulners.com
- NVD record mirror (Vulners) vulners.com
- OpenCVE entry with CISA SSVC data app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 03:34.
Original description (NVD)
Out-of-bounds read in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.