Windows Shell: Remote code execution through heap-based buffer overflow

Summary

A heap-based buffer overflow in the Windows Shell component allows an unauthenticated attacker to execute code remotely over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates that no privileges or user interaction are required and that the impact on confidentiality, integrity and availability is high. The sources do not describe the exact entry point, so it is unknown whether internet-facing services are needed.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to below 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to below 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to below 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to below 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to below 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to below 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to below 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to below 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to below 10.0.26300.9711)
• Windows Server 2012, including Server Core (6.2.9200.0 to below 6.2.9200.26434)
• Windows Server 2012 R2, including Server Core (6.3.9600.0 to below 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 to below 10.0.14393.9612)
• Windows Server 2025: not listed in the official CVE record; unverified, to be checked on the MSRC page

Fixed in

• Fixed builds are the first builds outside the affected ranges listed in the CVE record, e.g. 10.0.14393.9612 (Windows 10 1607 and Server 2016) and 6.2.9200.26434 (Server 2012).
• Confirm the exact fixed build per product on the MSRC page and install the October 2026 security update.
• Windows Server 2025 update reference KB5126646 is unverified.

Workaround

Unknown. No vendor or third-party workaround is known; patching is the only sourced remediation.

Exploitation

• Not listed in CISA KEV (per OpenCVE).
• CISA SSVC data: exploitation none, automatable yes, technical impact total.
• EPSS below 1%.
• No public proof of concept found; absence in search results does not prove that no exploit exists.
• Zero Day Initiative lists this CVE among the October 2026 bugs it considers wormable; this is a researcher's classification, not evidence of exploitation.

Our recommendation

• Patch with priority: Windows Server systems reachable from the internet or less-trusted networks first, then client systems.
• Confirm your build numbers against the MSRC page and test the October 2026 cumulative update before rollout.
• Verify the installation on every Windows version in use.
• As an interim measure, restrict unnecessary inbound network access to servers.
• Monitor for unusual network activity against Windows hosts until patched.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-83782 msrc.microsoft.com
• OpenCVE: CVE-2026-83782 (CISA SSVC data) app.opencve.io
• Vulners Microsoft record: MS:CVE-2026-83782 vulners.com
• Vulners NVD record: NVD:CVE-2026-83782 vulners.com
• Zero Day Initiative: October 2026 security update review www.zerodayinitiative.com
• GitHub issue with EPSS data: CVE-2026-83782 github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:34.