Microsoft Windows CSC Service: Stack-based buffer overflow enables privilege escalation

Summary

A stack-based buffer overflow in the Windows Client-Side Caching (CSC) Service allows an authorized local attacker to elevate privileges. An attacker needs a low-privileged account and local access, for example code already running as a user. Successful exploitation can lead to full control of the affected system (SYSTEM level).

Affected

• Windows 10 Version 1607 (build 10.0.14393.0 before 10.0.14393.9612)
• Windows 10 Version 1809 (build 10.0.17763.0 before 10.0.17763.9376)
• Windows 10 Version 21H2 (build 10.0.19044.0 before 10.0.19044.7807)
• Windows 10 Version 22H2 (build 10.0.19045.0 before 10.0.19045.7807)
• Windows 11 Version 23H2 (build 10.0.22631.0 before 10.0.22631.7652)
• Windows 11 Version 24H2 (build 10.0.26100.0 before 10.0.26100.9711)
• Windows 11 Version 25H2 (build 10.0.26200.0 before 10.0.26200.9711)
• Windows 11 Version 26H1 (build 10.0.28000.0 before 10.0.28000.3231)
• Windows 11 Version 26H2 (build 10.0.26300.0 before 10.0.26300.9711)
• Windows Server 2012 (build 6.2.9200.0 before 6.2.9200.26434), including Server Core
• Windows Server 2012 R2 (build 6.3.9600.0 before 6.3.9600.23470), including Server Core
• Windows Server 2016 (build 10.0.14393.0 before 10.0.14393.9612)

Fixed in

• Apply the October 2026 security update for each affected branch (Patch Tuesday, 13 October 2026).
• Target builds: 10.0.14393.9612 (Windows 10 1607 / Server 2016), 10.0.17763.9376 (1809), 10.0.19044.7807 (21H2), 10.0.19045.7807 (22H2), 10.0.22631.7652 (23H2), 10.0.26100.9711 (24H2), 10.0.26200.9711 (25H2), 10.0.28000.3231 (26H1), 10.0.26300.9711 (26H2), 6.2.9200.26434 (Server 2012), 6.3.9600.23470 (Server 2012 R2).
• KB number for Windows 10 1607: Unknown.

Workaround

Unknown. No workaround was found in the sources. Apply the update.

Exploitation

• No evidence of active exploitation in the sources checked. CISA's KEV catalog was not checked directly.
• No public proof-of-concept found.
• Microsoft temporal vector E:U (no public exploit code known).
• CISA SSVC: exploitation none, automatable no, technical impact total.
• EPSS about 0.004 (low predicted exploitation probability).

Our recommendation

• Patch all affected Windows systems with the October 2026 security update.
• Inventory systems, especially Windows 10 1607 and Windows Server 2012/2012 R2/2016, and check whether they are still supported.
• Prioritise shared or multi-user machines, terminal/RDP hosts and endpoints with weak local controls.
• Limit interactive and local logon to trusted users until patching is complete.
• Monitor for unusual privilege escalation activity on endpoints.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83699 msrc.microsoft.com
• Qualys: Microsoft Patch Tuesday October 2026 review blog.qualys.com
• Talos: Microsoft Patch Tuesday for October 2026 blog.talosintelligence.com
• VulDB entry 418889 vuldb.com
• Vulners MSCVE mirror: MS:CVE-2026-83699 vulners.com
• Vulners NVD mirror: NVD:CVE-2026-83699 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 03:18.