Windows 10 1607: Local elevation of privilege in TCP/IP stack

Summary

A flaw in the Windows TCP/IP stack, caused by an incorrect conversion between numeric types (CWE-681), allows an attacker with local access and a low-privilege account to elevate their privileges. The CVSS 3.1 base score is 7.8 (High), with high impact on confidentiality, integrity and availability. The attack is not directly reachable from the internet, but it is relevant wherever untrusted or low-privileged users can log on locally, such as kiosks and fixed-function devices.

Affected

• Microsoft Windows 10 Version 1607 (Enterprise LTSB 2016): builds 10.0.14393.0 to below 10.0.14393.9612
• The official CVE record also lists other Windows 10, Windows 11 and Windows Server versions. Check the MSRC advisory for the complete list.

Fixed in

• Windows 10 Version 1607: build 10.0.14393.9612 or later (October 2026 update, KB5126868, per Microsoft release information; confirm on MSRC)
• Fixed builds for other affected products: see MSRC advisory

Workaround

Unknown. No vendor-documented workaround was found.

Exploitation

• No evidence of exploitation in the wild found at the time of research.
• Not listed in CISA KEV.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof-of-concept exploit found; VulDB states that no exploit is available.

Our recommendation

• Apply the October 2026 security update (build 10.0.14393.9612 or later) to all Windows 10 1607 systems, after verifying the build number on MSRC.
• Windows 10 1607 (LTSB 2016) is out of support: plan an upgrade to a supported release, or consider paid Extended Security Updates if an upgrade is not possible in time.
• Restrict local logon to trusted, least-privileged accounts on affected devices.
• Check whether Exchange runs on the same hosts before deploying the update, as the October 2026 update has a known Exchange issue with a documented registry workaround.
• Monitor for unusual privilege changes and new local administrator accounts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83872 msrc.microsoft.com
• Windows 10 1607 and Windows Server 2016 release health status learn.microsoft.com
• Windows release information learn.microsoft.com
• NVD mirror on Vulners: CVE-2026-83872 vulners.com
• OpenCVE: CVE-2026-83872 app.opencve.io
• VulDB: CVE-2026-83872 vuldb.com
• 4sysops: Windows 10 LTSB 2016 end of support and ESU 4sysops.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:44.