Windows COM+ Event System Service: Heap-based buffer overflow

Summary

A heap-based buffer overflow in the Windows COM+ Event System Service allows an authorized local user with low privileges to elevate privileges on the affected system. Successful exploitation would give the attacker high impact on confidentiality, integrity and availability of that system. The attacker needs an existing foothold on the machine, and no user interaction is required. Microsoft reports no public disclosure and no exploitation at the time of release.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9711
• Windows Server 2012 (including Server Core): 6.2.9200.0 to before 6.2.9200.26434
• Windows Server 2012 R2 (including Server Core): 6.3.9600.0 to before 6.3.9600.23470
• Windows Server 2016: 10.0.14393.0 to before 10.0.14393.9612

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.7652
• Windows 11 Versions 24H2, 25H2 and 26H2: 10.0.26100.9711, 10.0.26200.9711 and 10.0.26300.9711
• Windows 11 Version 26H1: 10.0.28000.3231
• Windows Server 2012: 6.2.9200.26434
• Windows Server 2012 R2: 6.3.9600.23470
• Note: the build numbers are the first builds containing the fix, from the CNA data. Verify the exact KB on the MSRC page.

Workaround

Unknown.

• Microsoft's advisory excerpt did not show a mitigation section.
• A third-party source advises disabling the COM+ Event System Service where it is not required. Test first, as dependent applications may be affected.

Exploitation

• Microsoft: not publicly disclosed, not exploited.
• Microsoft exploitability assessment: Exploitation More Likely.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• EPSS score: 0.0041.
• No public proof-of-concept or in-the-wild reports were found at the time of research. CISA KEV and GitHub were not checked.

Our recommendation

• Install the October 2026 security update on all affected Windows systems, prioritising multi-user systems, terminal and Remote Desktop servers, file and application servers.
• Verify the fixed build for each system, especially Windows 10 Version 1607 and Windows Server 2016, against the MSRC page.
• Check whether Windows 10 Version 1607 still receives security updates for your licence with Microsoft.
• Where the COM+ Event System Service is not required, consider disabling it until patching is complete, after testing.
• Restrict local logon to trusted users and monitor for unusual privilege changes and new services.
• Recheck CISA KEV and public exploit sources before finalising priority.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83830 msrc.microsoft.com
• Vulners: NVD record CVE-2026-83830 vulners.com
• Vulners: CVE list record CVE-2026-83830 vulners.com
• Qualys: Microsoft Patch Tuesday October 2026 review blog.qualys.com
• OpenCVE: CVE-2026-83830 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:56.