Windows Input System: Type confusion allows local privilege escalation
Summary
A type confusion flaw in the Windows Input System of Windows 10 version 1809 and Windows Server 2019 allows an attacker with a local, low-privileged account to elevate privileges. No user interaction is required, and the impact on confidentiality, integrity and availability is high (CVSS 7.8). The risk is mainly on shared systems, terminal servers and kiosks where an attacker already has a standard user account or a session. CISA's SSVC assessment lists exploitation as none and the issue as not automatable.
Affected
- Windows 10 Version 1809 (builds below 10.0.17763.9376)
- Windows Server 2019, including Server Core installation (builds below 10.0.17763.9376)
- Other Windows 10, Windows 11 and Windows Server versions are also listed in the CVE record (see MSRC)
Fixed in
- Windows 10 Version 1809 and Windows Server 2019: build 10.0.17763.9376 or later, according to the official CVE record
- Install the October 2026 security update from Microsoft. The KB number is unverified; confirm it in the MSRC Security Update Guide.
Workaround
- No vendor-specific workaround is known.
- General measures, not Microsoft guidance: restrict local privilege escalation paths and monitor for unusual input system activity until the update is installed.
Exploitation
- Not known to be exploited in the wild.
- CISA SSVC: exploitation none, automatable no.
- Not listed in CISA KEV.
- No public proof of concept was found; this does not rule one out.
Our recommendation
- Inventory systems running Windows 10 1809 or Windows Server 2019, especially terminal servers, RDS hosts and kiosks.
- Install the October 2026 cumulative update on affected systems as part of standard monthly patching, after confirming the KB number on MSRC.
- Restrict local logons and standard user access on shared systems.
- Monitor for unexpected privilege changes and anomalous activity on affected systems.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows Input System
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation more likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5127648, KB5126651, KB5126655, KB5126657, KB5126646, KB5126653
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-83763 msrc.microsoft.com
- Vulners: NVD record CVE-2026-83763 vulners.com
- OpenCVE: CVE-2026-83763 app.opencve.io
- Strix: CVE-2026-83763 www.strix.ai
- Qualys: Microsoft Patch Tuesday October 2026 review blog.qualys.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 03:05.
Original description (NVD)
Access of resource using incompatible type ('type confusion') in Windows Input System allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.