Microsoft Windows: Privilege escalation in Windows Virtual Input

Summary

Improper authorization in the Windows Virtual Input component allows a local, authorized attacker to elevate privileges. The NVD CPE lists only Windows 10 1809, but the CNA record covers several further Windows 10, Windows 11 and Windows Server builds. The attacker needs a local foothold and low privileges, for example via a malicious or compromised user account, and the CVSS impact on confidentiality, integrity and availability is high.

Affected

• Windows 10 Version 1809 (10.0.17763.0 to < 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to < 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to < 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to < 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to < 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to < 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to < 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to < 10.0.26300.9711)
• Windows Server 2019 and Server Core installation (10.0.17763.0 to < 10.0.17763.9376)
• Windows Server 2022 (10.0.20348.0 to < 10.0.20348.5761)

Fixed in

• Windows 10 1809 and Windows Server 2019: 10.0.17763.9376
• Windows 10 21H2: 10.0.19044.7807
• Windows 10 22H2: 10.0.19045.7807
• Windows 11 23H2: 10.0.22631.7652
• Windows 11 24H2: 10.0.26100.9711
• Windows 11 25H2: 10.0.26200.9711
• Windows 11 26H1: 10.0.28000.3231
• Windows 11 26H2: 10.0.26300.9711
• Windows Server 2022: 10.0.20348.5761 (derived from the affected range, verify on MSRC)

Patch KBs per Tenable listings: KB5126651 (Windows 10 1809 / Server 2019), KB5126653 (Windows 11 23H2). Verify all builds on MSRC.

Workaround

Unknown. No confirmed workaround in the available sources. Do not act on the truncated OpenCVE text about disabling Windows Virtual Input without the full MSRC advisory.

Exploitation

• Not listed in the CISA KEV catalog.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• CVSS temporal vector E:U (exploit code maturity: unproven).
• No public proof of concept found in research; this is not confirmation that none exists.
• VulDB market estimate USD 5k-25k; this is a broker price estimate, not evidence of exploitation.
• Microsoft 'Exploitation Detected' flag: unknown.

Our recommendation

• Confirm exact builds on MSRC and in your asset inventory, including Server 2019/2022 and Windows 11 builds that the CPE does not list.
• Deploy the October 2026 cumulative update, prioritising multi-user systems, terminal servers and servers.
• Identify unsupported Windows 10 builds that cannot receive the fix and plan upgrades or ESU enrolment.
• Monitor MSRC and CISA KEV for changes in exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83791 msrc.microsoft.com
• NVD record mirror (vulners) vulners.com
• CVE List record mirror (vulners) vulners.com
• OpenCVE CVE-2026-83791 app.opencve.io
• VulDB entry 419004 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 03:01.