Windows 10 Version 1607: Privilege escalation via heap-based buffer overflow

Summary

Windows 10 Version 1607 (and Windows Server 2016, which shares build 14393) contains a heap-based buffer overflow in the Microsoft Account component. An authorized local user with low privileges can exploit it to elevate privileges. Network exploitation is not expected according to the CVSS vector (AV:L), and the function of the affected component is not documented in the sources. Version 1607 is end of support, so the October 2026 update is the last security fix for these systems.

Affected

• Windows 10 Version 1607 (Enterprise LTSB 2016): builds 10.0.14393.0 to below 10.0.14393.9612
• Windows Server 2016: builds 10.0.14393.0 to below 10.0.14393.9612

Fixed in

• Build 10.0.14393.9612 or later, delivered with the October 2026 security update KB5126868 (verify on the MSRC advisory)

Workaround

• Unknown. No workaround or mitigation was found in the sources.

Exploitation

• Microsoft has not publicly disclosed the vulnerability (Publicly disclosed: No).
• Exploitation in the wild: unknown. No public proof of concept was found.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• EPSS score: 0.00348 (low).

Our recommendation

• Identify all Windows 10 1607 and Windows Server 2016 systems and check their build numbers.
• Install the October 2026 security update (build 10.0.14393.9612 or later) on all systems that can still be patched.
• Plan the replacement of 1607 devices, for example with Windows 11 Enterprise LTSC 2024, or document a decision on Extended Security Updates with Microsoft or a Cloud Solution Provider.
• Limit local user accounts and monitor for signs of privilege escalation on endpoints.
• Before rolling out the update on on-premises Exchange servers, check the known issue with OWA sign-in and email sending listed by Microsoft.
• Priority: medium for supported Windows versions; high for remaining 1607 devices, which no longer receive security updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-83847 msrc.microsoft.com
• Microsoft Learn: Windows 10 1607 and Windows Server 2016 release health learn.microsoft.com
• Vulners: Microsoft CVE data for CVE-2026-83847 vulners.com
• Vulners: NVD record for CVE-2026-83847 vulners.com
• Strix: CVE-2026-83847 www.strix.ai
• 4sysops: Windows 10 Enterprise LTSB 2016 end of support and ESU 4sysops.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:51.