Windows Event Tracing: Heap-based buffer overflow allows local code execution

Summary

A heap-based buffer overflow in Windows Event Tracing affects multiple supported and legacy Windows 10, Windows 11 and Windows Server versions. An attacker with local access, such as a logged-on user or code already running on the host, can execute code with the rights of the affected process and may gain full control of the system. The CVSS vector is local (AV:L) and requires user interaction (UI:R); the official title says "Remote Code Execution", but this is not a network-exploitable flaw.

Affected

• Windows 10 Version 1607 and Windows Server 2016: builds before 10.0.14393.9612
• Windows 10 Version 1809 and Windows Server 2019: builds before 10.0.17763.9376
• Windows 10 Version 21H2: builds before 10.0.19044.7807
• Windows 10 Version 22H2: builds before 10.0.19045.7807
• Windows 11 Version 23H2: builds before 10.0.22631.7652
• Windows 11 Version 24H2 and Windows Server 2025: builds before 10.0.26100.9711
• Windows 11 Version 25H2: builds before 10.0.26200.9711
• Windows 11 Version 26H1: builds before 10.0.28000.3231
• Windows 11 Version 26H2: builds before 10.0.26300.9711
• Windows Server 2012 and 2012 R2: builds before 6.2.9200.26434 and 6.3.9600.23470
• Windows Server 2022: builds before 10.0.20348.5761 (per NVD-derived data, not confirmed in the official record)

Fixed in

• Install the October 2026 Windows security update for your version (Patch Tuesday, October 13, 2026).
• Fixed builds: see the list of affected versions above; confirm exact build numbers and KB articles on the MSRC advisory before deployment.

Workaround

Unknown. No workaround or mitigation is documented by the vendor. Until patched, limit local logon to trusted users and restrict who can run code on affected hosts.

Exploitation

• Publicly disclosed: no
• Exploited in the wild: no
• MSRC exploitability assessment: Exploitation Less Likely
• CISA SSVC: exploitation none, automatable no, technical impact total
• Not listed in CISA KEV at the time of research
• No public proof of concept found in the research; recheck before final prioritisation

Our recommendation

• Inventory all Windows hosts and identify Windows 10 1607, Windows 10 1809, Windows Server 2012, 2012 R2, 2016 and 2019 systems first.
• Apply the October 2026 security update to all affected systems and verify the installed build number.
• Confirm that legacy systems still receive security updates, and plan an upgrade where they do not.
• Restrict local logon and administrative rights on legacy, kiosk, POS and industrial systems until they are patched.
• Monitor for unusual local process activity and privilege escalation on affected hosts.
• Priority: moderate by default; raise to high for 1607 or Server 2016 hosts that process sensitive data.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-83836 msrc.microsoft.com
• MSRC Security Update Guide (en-US): CVE-2026-83836 msrc.microsoft.com
• Vulners NVD record: CVE-2026-83836 vulners.com
• OpenCVE: CVE-2026-83836 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:54.