Microsoft Windows: Heap-based buffer overflow in Text Shaping

Summary

A heap-based buffer overflow in the Windows Text Shaping component allows code execution. The CVSS vector published by NVD describes a network attack without privileges or user interaction, but Zero Day Initiative describes the attack as requiring an authorized local attacker. Until the Microsoft advisory settles the attack vector, treat the issue as critical.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9711)
• Windows Server 2012 and Server Core installation (6.2.9200.0 to before 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core installation (6.3.9600.0 to before 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 to before 10.0.14393.9612)

Fixed in

• Install Microsoft's October 2026 security update for all affected versions.
• The build numbers above are taken from the CVE record and are not yet verified against the Microsoft advisory. Sources disagree on some fixed builds.
• Patch KB5126646 (Server 2025) and KB5126657 (Windows 10 21H2/22H2) are named in third-party pages but are not confirmed as the fix for this CVE.

Workaround

Unknown. No workaround or mitigation was found in the sources.

Exploitation

• No confirmed exploitation in the wild was found.
• CISA SSVC data in the CVE record lists exploitation as none and automatable as yes.
• A Tenable page marks an exploit as available and gives a CISA KEV due date, but it is unclear whether this applies to this CVE.
• No public proof of concept was found.

Our recommendation

• Apply the October 2026 cumulative update to all Windows clients and servers, starting with internet-facing servers and file, print and RDP servers.
• Confirm the fixed build against the Microsoft advisory and check the patched build on each host.
• Check the CISA KEV catalogue for this CVE before closing the item.
• Re-check NVD and the Microsoft advisory within a few days, since NVD analysis was still pending and the attack vector is disputed.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83770 msrc.microsoft.com
• Zero Day Initiative: October 2026 Security Update Review www.zerodayinitiative.com
• OpenCVE: CVE-2026-83770 app.opencve.io
• Vulners NVD record: CVE-2026-83770 vulners.com
• Tenable plugin 365467 www.tenable.com
• Strix: CVE-2026-83770 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:36.