Windows Management Instrumentation: Heap-based buffer overflow (privilege escalation)

Summary

A heap-based buffer overflow in Windows Management Instrumentation (WMI), a Windows component, allows a local attacker with low privileges to elevate their privileges. The CVSS 3.1 score is 7.8 (High) with high impact on confidentiality, integrity and availability. An attacker needs a foothold on the system first, for example through a phished user or a compromised low-privilege account, so the flaw is not remotely exploitable on its own.

Affected

• Microsoft Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9612)
• Microsoft Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9376)
• Microsoft Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7807)
• Microsoft Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7807, per CNA record; a third-party mirror lists a different bound, to be verified)
• Microsoft Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7652)
• Microsoft Windows 11 Version 24H2, 25H2, 26H1 and 26H2 (listed in CNA record; exact builds to be verified)
• Microsoft Windows Server 2012 and Server Core installation (6.2.9200.0 to before 6.2.9200.26434)
• Microsoft Windows Server 2012 R2 and Server Core installation (6.3.9600.0 to before 6.3.9600.23470)
• Microsoft Windows Server 2016 (10.0.14393.0 to before 10.0.14393.9612)

Fixed in

• Fixed in October 2026 Windows updates, as listed by the vendor advisory and the CNA data
• Windows 10 Version 1607: 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.7807
• Windows 11 Version 23H2: 10.0.22631.7652
• Windows Server 2012: 6.2.9200.26434
• Windows Server 2016: 10.0.14393.9612
• Fixed builds for Windows 11 24H2, 25H2, 26H1, 26H2 and Windows Server 2012 R2: Unknown.
• Verify all builds against the MSRC advisory before rollout.

Workaround

Unknown. No workaround is documented in the sources reviewed. Patching is the only documented remedy.

Exploitation

• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• Not listed in the CISA Known Exploited Vulnerabilities catalog.
• EPSS score 0.00361.
• No public proof of concept found in the searches performed. This does not prove that none exists.

Our recommendation

• Install the October 2026 Windows security updates on all affected systems, prioritising shared workstations, Remote Desktop or terminal servers, and file servers with interactive users.
• Confirm the update path for Windows Server 2012, which is end-of-support, and check the MSRC advisory for the exact fixed builds.
• Restrict local logons and limit low-privilege accounts on servers and shared systems.
• Monitor for unusual privilege changes or new local administrator accounts, and re-check for public exploits.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide (MSRC advisory) msrc.microsoft.com
• Vulners NVD record vulners.com
• Vulners CVElist record vulners.com
• OpenCVE app.opencve.io
• Strix CVE record (CNA-derived versions) www.strix.ai
• VulDB entry vuldb.com
• Tenable plugin (Windows Server 2012 update) www.tenable.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 03:02.