Windows SMB Client: Heap-based buffer overflow allows privilege escalation

Summary

A heap-based buffer overflow (CWE-122) in the Windows SMB Client affects several Windows 10, Windows 11 and Windows Server versions, including Windows 10 version 1607 and Windows Server 2016. A network attacker may be able to elevate privileges. The sources state that the attack generally requires the victim to connect to an attacker-controlled SMB server. The CVSS score conflicts between sources: the CVE data gives 9.8 with no user interaction, while third-party aggregators give 8.8 with user interaction required, so verify the score on NVD.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9612)
• Windows Server 2016 (10.0.14393.0 to before 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9376)
• Windows 10 Version 21H2 and 22H2 (10.0.19044.0 to before 10.0.19044.7807; 10.0.19045.0 to before 10.0.19045.7807)
• Windows 11 Version 23H2, 24H2, 25H2, 26H1 and 26H2 (see the MSRC advisory for exact builds)
• Windows Server 2012 and 2012 R2 (6.2.9200.0 to before 6.2.9200.26434; 6.3.9600.0 to before 6.3.9600.23470)

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: build 10.0.14393.9612 or later (per the CVE record; KB number unknown)
• Other versions: the fixed builds listed in the MSRC advisory
• Verify the exact fixed builds and KB numbers on the MSRC advisory before deployment.

Workaround

Unknown. No Microsoft mitigation or workaround was found in the research.

Exploitation

• Not listed in the CISA KEV catalog.
• No public proof-of-concept exploit was found in the research; this does not rule out that one exists.
• No reports of exploitation in the wild were found.
• CISA SSVC assessment: exploitation none, not automatable, total technical impact.

Our recommendation

• Confirm whether any host runs Windows 10 version 1607 and whether it still receives security updates.
• Install the October 2026 security update for each affected version as soon as possible, prioritising user workstations.
• Block outbound SMB (TCP 445) from user networks to the internet.
• Check the MSRC advisory for the exact fixed builds and the verified CVSS vector.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83789 msrc.microsoft.com
• OpenCVE: CVE-2026-83789 app.opencve.io
• Vulners NVD: CVE-2026-83789 vulners.com
• Strix: CVE-2026-83789 www.strix.ai
• Qualys: Microsoft Patch Tuesday October 2026 review blog.qualys.com
• SonicWall: Microsoft security bulletin coverage for October 2026 www.sonicwall.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:34.