Microsoft OpenSSH for Windows: Heap buffer overflow enables local privilege escalation

Summary

A heap-based buffer overflow in Microsoft OpenSSH for Windows allows an authorized local attacker to elevate privileges. Exploitation requires a local account with low privileges and a high-complexity condition (CVSS 7.0 per NVD). According to the available data, remote exploitation is not possible.

Affected

• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): 10.0.17763.0 to below 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to below 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to below 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to below 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to below 10.0.26100.9711
• Windows 11 Version 25H2 and 26H2: below 10.0.26200.9711 and 10.0.26300.9711 respectively
• Windows 11 Version 26H1: 10.0.28000.0 to below 10.0.28000.3231
• Windows Server 2022: 10.0.20348.0 to below 10.0.20348.5761
• Windows Server 2025 (including Server Core): 10.0.26100.0 to below 10.0.26100.33650
• Note: The NVD CPE entry lists only Windows 10 1809; the affected list above is taken from the CNA record.

Fixed in

• Fixed builds as reported by third-party mirrors (not yet verified on MSRC):
• Windows 10 1809 and Server 2019: 10.0.17763.9376
• Windows 10 21H2: 10.0.19044.7807; Windows 10 22H2: 10.0.19045.7807
• Windows 11 23H2: 10.0.22631.7652; Windows 11 24H2: 10.0.26100.9711
• Windows 11 26H1: 10.0.28000.3231; Windows 11 25H2 and 26H2: 10.0.26200.9711 and 10.0.26300.9711
• Windows Server 2022: 10.0.20348.5761; Windows Server 2025: 10.0.26100.33650
• Exact patched builds for every edition: Unknown. Verify on the MSRC advisory.

Workaround

• No vendor-published workaround or interim mitigation known.
• Possible measure (own suggestion, verify with MSRC): if the OpenSSH Server feature is not required on a host, disable it until the update is installed.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total.
• Not listed in the CISA KEV catalog.
• EPSS approximately 0.2 percent (0.00221).
• No public proof of concept found in the searches performed; status unknown, recheck regularly.

Our recommendation

• Install the October 2026 Microsoft security update on all affected hosts, prioritizing Windows 10 1809 and Server 2019 systems.
• Verify the installed build against the MSRC advisory.
• Identify hosts with the OpenSSH feature installed and check whether the service is listening.
• Disable OpenSSH where it is not needed until patched.
• Restrict local logon on shared hosts and terminal servers, and monitor for unusual privilege changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide (MSRC advisory) msrc.microsoft.com
• NVD mirror on Vulners (version ranges) vulners.com
• OpenCVE: CVE record, SSVC and KEV status app.opencve.io
• MSRC mirror on Vulners vulners.com
• VulDB: local vector and CWE vuldb.com
• Strix: version table www.strix.ai
• Positive Technologies reference vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:06.