OpenSSH for Windows: Heap-based buffer overflow allows remote code execution

Summary

Microsoft's Windows port of OpenSSH, which includes the built-in SSH client and server, contains a heap-based buffer overflow. An unauthorized attacker can exploit it over the network to execute code. According to the CVE record, exploitation requires user interaction and has high attack complexity (CVSS 3.1: 7.5). CISA SSVC lists no known exploitation and marks the issue as not automatable.

Affected

• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): 10.0.17763.0 to before 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9711
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5761
• Windows Server 2025 (including Server Core): 10.0.26100.0 to before 10.0.26100.33650

Fixed in

• Windows 10 Version 1809 and Windows Server 2019: 10.0.17763.9376 or later (October 2026 cumulative update; third-party database cites KB5126651, verify on MSRC)
• Windows 10 Version 21H2: 10.0.19044.7807 or later
• Windows 10 Version 22H2: 10.0.19045.7807 or later
• Windows 11 Version 24H2: 10.0.26100.9711 or later
• Windows Server 2022: 10.0.20348.5761 or later
• Windows Server 2025: 10.0.26100.33650 or later
• Other listed versions: fixed builds per the MSRC advisory

Workaround

Unknown. Microsoft has not published a workaround in the sources reviewed. An unverified third-party suggestion to keep the built-in terminal support enabled is not confirmed and must not replace patching.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total
• Attack complexity high, no privileges required, user interaction required (CVSS 3.1: AV:N/AC:H/PR:N/UI:R)
• No public exploitation known at the time of review

Our recommendation

• Identify systems with the affected Windows versions and the OpenSSH client or server enabled
• Install the October 2026 cumulative update or later fixed build on all affected systems
• Restrict SSH access to trusted networks and administrators until patched
• Monitor SSH logs for unusual connections and crashes
• Verify fixed builds against the MSRC advisory before rollout

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83754 msrc.microsoft.com
• Vulners: CVE List record CVE-2026-83754 vulners.com
• Vulners: Microsoft (MS) record CVE-2026-83754 vulners.com
• Strix: CVE-2026-83754 www.strix.ai
• OpenCVE: CVE-2026-83754 app.opencve.io
• HiveForce Labs: October 2026 Patch Tuesday write-up www.hivepro.com
• Hive Pro: Microsoft October 2026 Patch Tuesday priority fixes www.hivepro.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 18:46.