Windows Sensor Data Service: Heap-based buffer overflow enables privilege escalation

Summary

A heap-based buffer overflow in the Windows Sensor Data Service allows an authorized local user to elevate privileges to a higher level. The attack requires local access and a low-privilege account; the CVSS base score is 7.8 (HIGH). Systems with shared logons, terminal servers or RDP access are most exposed.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): builds before 10.0.14393.9612
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9376
• Windows 10 Version 21H2: builds before 10.0.19044.7807
• Windows 10 Version 22H2: builds before 10.0.19045.7807
• Windows 11 Version 23H2: builds before 10.0.22631.7652
• Windows 11 Version 24H2: builds before 10.0.26100.9711
• Windows 11 Version 25H2: builds before 10.0.26200.9711
• Windows 11 Version 26H1: builds before 10.0.28000.3231
• Windows 11 Version 26H2: builds before 10.0.26300.9711
• Windows Server 2022: builds before 10.0.20348.5761
• Windows Server 2025: not listed in the CNA record; verify on MSRC

Fixed in

• Install the Microsoft security update for October 2026 (build numbers as listed under affected, or later)
• KB numbers per build: check MSRC; third-party sources cite KB5126651 (Windows 10 1809 / Server 2019) and KB5126646 (Server 2025), not verified against MSRC

Workaround

Unknown. No vendor-documented workaround found; patching is the recommended remedy.

Exploitation

• CISA SSVC assessment: exploitation none, not automatable, total technical impact
• Third-party sources conflict: one aggregator labels it as known exploited, ThreatForesight rates exploit maturity as unproven
• EPSS about 0.3% (third-party value)
• No CISA KEV entry and no public proof of concept confirmed in the sources reviewed

Our recommendation

• Install the October 2026 security update on all affected Windows systems, prioritizing shared machines, terminal servers and RDP hosts
• Confirm patch status of Windows 10 1607 and Server 2016 systems first, as they are old and may still be in use
• Check the MSRC advisory for exact build and KB numbers before rollout
• Monitor for suspicious privilege escalation and new local accounts; verify CISA KEV status

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83639 msrc.microsoft.com
• NVD record mirror (Vulners) vulners.com
• CVE list record (Vulners) vulners.com
• OpenCVE CVE-2026-83639 app.opencve.io
• Strix CVE-2026-83639 (CVSS vector) www.strix.ai
• ThreatForesight CVE-2026-83639 (exploit maturity) threatforesight.com
• Hackerstorm CVE-2026-83639 (third-party, EPSS) www.hackerstorm.com
• Tenable CVE database www.tenable.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 03:28.