Windows: Heap-based buffer overflow in Windows Media enables privilege escalation

Summary

A heap-based buffer overflow in the Windows Media component of Windows allows an authorized local attacker to elevate privileges, potentially up to SYSTEM. The attacker needs existing low-privileged access to the system, and no user interaction is required. The flaw is not remotely exploitable on its own, but it matters once an attacker has a foothold through phishing, stolen credentials or malware. MSRC rates exploitation as unlikely, and no exploitation or public disclosure is known.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7807)
• Windows 11 Versions 23H2, 24H2, 25H2, 26H1, 26H2 (per CNA record; verify with MSRC)
• Windows Server 2012 and 2012 R2 (incl. Server Core)
• Windows Server 2016 (10.0.14393.0 to before 10.0.14393.9612)
• Other Windows Server editions listed in the MSRC advisory (e.g. Server 2019, 2022, 2025)

Fixed in

• Windows 10 1607 and Server 2016: 10.0.14393.9612
• Windows 10 1809: 10.0.17763.9376
• Windows 10 21H2: 10.0.19044.7807
• Windows 10 22H2: 10.0.19045.7807
• Windows Server 2012 / 2012 R2: 6.2.9200.26434 / 6.3.9600.23470
• Windows 11 23H2: 10.0.22631.7652; 24H2 and 25H2: 10.0.26100.9711 / 10.0.26200.9711
• Knowledge base articles: KB5126651 (Windows 10 1809, Server 2019) and KB5126646 (Server 2025) per Tenable; other KB numbers unknown
• Check the MSRC page for the complete list of security updates

Workaround

Unknown. No mitigation has been documented by Microsoft. Restricting execution of media files from untrusted sources is a generic suggestion only.

Exploitation

• Publicly disclosed: No
• Exploited in the wild: No
• MSRC exploitability assessment: Exploitation Unlikely
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total
• EPSS: 0.00353 (very low)
• CISA KEV and public proof-of-concept code: not checked

Our recommendation

• Install the October 2026 security update for all affected Windows versions, prioritizing multi-user, shared and terminal server systems.
• Identify all Windows 10 1607, 1809, 21H2, Windows 11 and Server 2012 to 2025 systems and confirm the installed build.
• Plan an upgrade for any Windows 10 1607 systems, as this build is end-of-life.
• Verify the affected version list and KB numbers on the MSRC page and check CISA KEV before closing the item.
• Monitor for unusual privilege changes or new local services on affected hosts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83641 msrc.microsoft.com
• Vulners: CVE-2026-83641 (CNA data) vulners.com
• Vulners CVELIST: CVE-2026-83641 vulners.com
• Vulners MSCVE: MS:CVE-2026-83641 (KB numbers) vulners.com
• OpenCVE: CVE-2026-83641 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 03:31.