Windows Volume Manager Extension Driver: Local privilege escalation

Summary

An out-of-bounds read in the Windows Volume Manager Extension Driver allows an authorized local user to elevate privileges. Exploitation requires local access, a high attack complexity and a low-privileged account. Successful exploitation would affect confidentiality, integrity and availability, so the flaw is a serious step in an attack that already has a foothold on the system.

Affected

• Windows 10 Version 1607 (10.0.14393.0 before 10.0.14393.9612)
• Windows 10 Version 1809 (before 10.0.17763.9376), 21H2 (before 10.0.19044.7807), 22H2 (before 10.0.19045.7807)
• Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 (see MSRC for exact builds)
• Windows Server 2012, 2012 R2 and 2016 (see MSRC for exact builds)

Fixed in

• Windows 10 Version 1607: KB5126868 (OS Build 14393.9612), October 13, 2026
• Latest Windows 10 1607 build: KB5134123 (OS Build 14393.9615), October 26, 2026; whether it addresses this CVE is unconfirmed
• Other products: see the fixed builds in the MSRC advisory

Workaround

Unknown. No vendor mitigation was found.

• For devices that cannot be patched, restrict local logon and code execution to trusted users, and isolate or replace the device.

Exploitation

• CISA SSVC: exploitation none, automatable no
• Not listed in the CISA KEV catalog
• EPSS about 0.25% to 0.29%
• No public proof of concept found in our searches

Our recommendation

• Inventory all Windows 10 1607 and Windows Server 2016 hosts.
• Install KB5126868, then KB5134123, or migrate devices that cannot be upgraded.
• Windows 10 Enterprise LTSB 2016 reached end of updates on October 13, 2026. Whether an Extended Security Update option exists is unknown and must be checked.
• Verify the fixed build per product in the MSRC advisory.
• Review local admin and logon rights on remaining legacy hosts.
• Install the October 2026 cumulative updates on all other Windows versions.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83694 msrc.microsoft.com
• KB5126868: Windows 10 1607 security update support.microsoft.com
• KB5134123: Windows 10 1607 update support.microsoft.com
• Windows 10 1607 and Windows Server 2016 release health status learn.microsoft.com
• NVD record via Vulners: CVE-2026-83694 vulners.com
• OpenCVE: CVE-2026-83694 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:33.