Microsoft Windows: Spoofing vulnerability in Windows Internet (wininet.dll)

Summary

A spoofing vulnerability in the Windows Internet library (wininet.dll) affects several supported Windows 10, Windows 11 and Windows Server versions. An authenticated local user with low privileges can exploit it without user interaction, which changes the security scope and can lead to high impact on confidentiality and integrity. The vulnerability is not remotely exploitable on its own, and the CVSS base score from NVD is 8.4. Risk is highest on shared workstations, terminal servers and multi-user systems.

Affected

• Windows 10 Version 21H2: builds 10.0.19044.0 to below 10.0.19044.7807
• Windows 10 Version 22H2: builds 10.0.19045.0 to below 10.0.19045.7807
• Windows 11 Version 23H2: builds 10.0.22631.0 to below 10.0.22631.7652
• Windows 11 Version 24H2: builds 10.0.26100.0 to below 10.0.26100.9711
• Windows 11 Version 25H2: builds 10.0.26200.0 to below 10.0.26200.9711
• Windows 11 Version 26H1: builds 10.0.28000.0 to below 10.0.28000.3231
• Windows 11 Version 26H2: builds 10.0.26300.0 to below 10.0.26300.9711
• Windows Server 2022: builds 10.0.20348.0 to below 10.0.20348.5761
• Windows Server 2025 (including Server Core): builds 10.0.26100.0 to below 10.0.26100.33650

Fixed in

• Windows 10 Version 21H2: build 10.0.19044.7807 or later (per the CNA record; KB number unknown)
• Windows 10 Version 22H2: build 10.0.19045.7807 or later
• Windows 11 Version 23H2: build 10.0.22631.7652 or later
• Windows 11 Version 24H2, 25H2 and 26H2: build 10.0.26100.9711, 10.0.26200.9711 or 10.0.26300.9711 or later
• Windows 11 Version 26H1: build 10.0.28000.3231 or later
• Windows Server 2022: build 10.0.20348.5761 or later
• Windows Server 2025: build 10.0.26100.33650 or later
• Windows 10 Version 21H2 Home, Pro and Enterprise: no fix expected, as these editions are out of support

Workaround

Unknown. Microsoft has not published a workaround in the sources reviewed.

• Restrict local user accounts and apply least privilege to applications that use wininet.dll.
• For unpatched devices, limit local logons and isolate or upgrade the system.

Exploitation

• No entry in CISA KEV; EPSS below 1 percent (very low).
• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof-of-concept or exploit found at the time of research.

Our recommendation

• Inventory all Windows systems and identify versions and builds.
• Install the October 2026 security update on all affected supported systems through the normal monthly cycle.
• Replace or upgrade Windows 10 Version 21H2 Home, Pro and Enterprise systems, as they are out of support and likely receive no fix.
• Prioritise shared workstations, terminal servers and multi-user systems.
• Limit local accounts and enforce least privilege.
• Verify the KB numbers and details on the MSRC advisory before rollout.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83845 msrc.microsoft.com
• Vulners CVE record (CVELIST) vulners.com
• Vulners NVD record vulners.com
• OpenCVE: CVE-2026-83845 app.opencve.io
• Microsoft: Windows 10 version 21H2 end of servicing learn.microsoft.com
• Microsoft: Extended Security Updates for Windows 10 www.microsoft.com
• VulDB: CVE-2026-83845 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:30.