Windows Management Instrumentation: Heap overflow enables local privilege escalation

Summary

A heap-based buffer overflow in Windows Management Instrumentation (WMI) allows an authorized local attacker to elevate privileges. The attacker needs a valid low-privilege account on the affected system and cannot exploit the flaw remotely. Successful exploitation can lead to administrator or SYSTEM rights and enable wider compromise of the host.

Affected

• Microsoft Windows 10 Version 1607 (10.0.14393.0 before 10.0.14393.9612)
• Microsoft Windows Server 2016 (10.0.14393.0 before 10.0.14393.9612)
• Microsoft Windows 10 Version 1809 (10.0.17763.0 before 10.0.17763.9376)
• Microsoft Windows 10 Version 21H2 and 22H2 (10.0.19044.0 before 10.0.19044.7807 and 10.0.19045.0 before 10.0.19045.7807)
• Microsoft Windows 11 Version 23H2, 24H2, 25H2 and 26H1/26H2 (see official CVE record for build ranges)
• Microsoft Windows Server 2012 and 2012 R2 (including Server Core)

Fixed in

• Microsoft security update released on 13 October 2026 (October 2026 Patch Tuesday)
• Windows 10 Version 1607 / Server 2016: build 10.0.14393.9612 or later (verify the KB number on the MSRC entry)
• Unknown: exact fixed builds for all other products; confirm on MSRC

Workaround

• Unknown. No workaround or interim mitigation was found in the sources.
• The security update is the remedy.

Exploitation

• Not listed in CISA's Known Exploited Vulnerabilities catalog.
• Microsoft rates exploit maturity as Unproven (E:U) at release.
• CISA SSVC data: exploitation none, automatable no, technical impact total.
• EPSS about 0.28% (very low).
• No public proof of concept was found; this does not prove that none exists.

Our recommendation

• Install the October 2026 security update on all affected systems, prioritising Windows Server 2016 and endpoints or terminal servers with many local users.
• Verify the fixed build and KB number on the MSRC entry before relying on them.
• Upgrade Windows 10 Version 1607 and other out-of-support systems rather than only patching them.
• Review local administrator rights and enforce strong, unique passwords and MFA to limit the impact of a compromised low-privilege account.
• Monitor for unusual WMI activity and unexpected privilege changes on hosts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83724 msrc.microsoft.com
• Qualys: Microsoft Patch Tuesday October 2026 review blog.qualys.com
• OpenCVE: CVE-2026-83724 app.opencve.io
• Vulners NVD record: CVE-2026-83724 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:25.