Windows TCP/IP: Heap-based buffer overflow enables local privilege escalation

Summary

The Windows TCP/IP network stack, a core component of Microsoft Windows, contains a heap-based buffer overflow. An authorized attacker with low privileges can exploit it locally to elevate privileges. Exploitation requires code execution or a logged-on account on the host, so it is not directly reachable from the internet. The CVSS score is 7.8 (High), and CISA SSVC rates the issue as not automatable.

Affected

• Windows 10 Version 1607 (builds below 10.0.14393.9612)
• Windows Server 2016 (builds below 10.0.14393.9612)
• Windows 10 Version 1809 (builds below 10.0.17763.9376)
• Windows 10 Version 21H2 (builds below 10.0.19044.7807)
• Windows 10 Version 22H2 (listed by one aggregator as below 10.0.19044.7807, likely a typo for 19045; verify with MSRC)
• Windows 11 Versions 23H2, 24H2, 25H2, 26H1 and 26H2, and Windows Server 2012 and 2012 R2 (see the official CVE record for builds)

Fixed in

• Windows 10 Version 1607: build 10.0.14393.9612 or later
• Other Windows versions: see the build numbers in the MSRC advisory
• KB number for Windows 10 1607: Unknown (not confirmed; verify in the MSRC Security Update Guide)

Workaround

Unknown. No vendor-documented workaround was found. Applying the security update is the fix.

Exploitation

• No evidence of exploitation in the wild found.
• CISA SSVC (Vulnrichment): Exploitation none, Automatable no, Technical Impact total.
• EPSS approximately 0.3% at the time of the aggregator snapshots.
• No public proof of concept found.
• Not found in the CISA KEV alerts reviewed; search coverage was limited, so re-check the KEV catalog directly.

Our recommendation

• Inventory all Windows 10 1607 and Windows Server 2016 hosts and confirm whether they still receive updates.
• Apply the October 2026 security update for each affected version, after confirming the KB and build in MSRC.
• Prioritise terminal servers, RDS hosts and multi-user systems, where a local foothold is most likely.
• Keep least-privilege access and endpoint protection in place, since exploitation requires an existing foothold.
• If a host cannot be patched or is out of support, plan an upgrade and isolate it in the meantime.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83678 msrc.microsoft.com
• CVE record mirror (Vulners CVELIST) vulners.com
• Vulners MSCVE entry (Microsoft) vulners.com
• OpenCVE entry with CISA SSVC data app.opencve.io
• Vulners Rapid7 entry (EPSS) vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 03:23.