Windows NTFS: Heap-based buffer overflow allows local code execution

Summary

A heap-based buffer overflow in the Windows NTFS file system component allows an authorized local attacker to execute code, per the CVE description (CWE-122, CVSS 7.8). The CNA record title says Remote Code Execution, which conflicts with the local attack vector in the description, so the exact attack path should be confirmed with Microsoft. The attacker needs local access and low privileges, so the main risk is privilege escalation or code execution after a foothold, such as a compromised user account on a shared multi-user host or server.

Affected

• Windows 10 Version 1607 (build 10.0.14393.0 to below 10.0.14393.9612)
• Windows 10 Version 1809 (below 10.0.17763.9376)
• Windows 10 Version 21H2 (below 10.0.19044.7807)
• Windows 10 Version 22H2 (below 10.0.19045.7807)
• Windows 11 Version 23H2 (below 10.0.22631.7652)
• Windows 11 Version 24H2 (build 26100; fixed build unresolved, sources disagree)
• Windows 11 Version 25H2 (below 10.0.26200.9711)
• Windows 11 Version 26H1 (below 10.0.28000.3231)
• Windows 11 Version 26H2 (below 10.0.26300.9711)
• Windows Server 2012 and Server Core (below 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core (below 6.3.9600.23470)
• Windows Server 2016 (below 10.0.14393.9612)
• Windows Server 2019 and Server 2022 are listed in the NVD data but not verified against the CNA record

Fixed in

• Install the Microsoft security update for this CVE from the October 2026 Patch Tuesday release.
• Exact KB numbers and fixed build for Windows 11 24H2 are unverified; check the MSRC Security Update Guide.

Workaround

Unknown. No mitigation was found in the sources; patching is the only documented remediation.

Exploitation

• No evidence of exploitation in the wild found.
• CISA SSVC data: exploitation none, automatable no, technical impact total.
• No public proof of concept found.
• EPSS about 0.0035 (very low).
• Absence from the CISA KEV catalog was not confirmed.

Our recommendation

• Apply the October 2026 cumulative update to all affected Windows builds in the normal patch cycle, with higher priority for multi-user systems and servers.
• Verify exact fixed builds in the MSRC Security Update Guide before relying on build numbers.
• Identify any Windows 10 1607 hosts; plan an upgrade, because that build is end of support and patching may not be sufficient.
• Restrict local logon on servers and shared hosts, and monitor for unusual local code execution.
• No emergency action is indicated by the available evidence.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide (MSRC) msrc.microsoft.com
• OpenCVE record CVE-2026-83640 app.opencve.io
• Vulners CVE list record vulners.com
• Vulners NVD record vulners.com
• Strix CVE record www.strix.ai
• SonicWall October 2026 Microsoft bulletin coverage www.sonicwall.com
• CrowdStrike Patch Tuesday analysis October 2026 www.crowdstrike.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 03:31.