Windows Direct Composition: Heap-based buffer overflow allows local privilege escalation
Summary
A heap-based buffer overflow in the Windows Direct Composition graphics component allows a local attacker with a low-privilege logged-on account to elevate privileges. Successful exploitation can lead to full compromise of the affected host. The component is not reachable from the internet, so an attacker first needs a foothold on the system, for example through phishing or malicious user code.
Affected
- Windows 10 Version 1607 below 10.0.14393.9612 (x64 and x86)
- Windows Server 2016 (including Server Core installation) below 10.0.14393.9612
- Other Windows 10, Windows 11 and Windows Server versions are also listed by Microsoft (see MSRC advisory)
Fixed in
- Windows 10 Version 1607 and Windows Server 2016: build 10.0.14393.9612 or later
- The KB number for the update is not confirmed here; take it from the MSRC page
Workaround
Unknown. No documented workaround found. The vendor update is the only confirmed remedy.
Exploitation
- Microsoft exploitability assessment: Unproven
- No exploitation in the wild found in our research; CISA KEV not checked directly
- No public proof-of-concept code found
- EPSS score 0.00355 (low)
Our recommendation
- Inventory all Windows 10 1607 and Windows Server 2016 hosts and compare build numbers with 10.0.14393.9612
- Install the October 2026 cumulative update from Microsoft (MSRC) on all affected systems
- Restrict local logon to trusted users and limit who can run untrusted code on shared 1607 systems until patched
- Verify the end-of-support date for Windows 10 1607 on Microsoft's lifecycle page; if support has ended or is ending, plan migration to a supported version
- Re-check MSRC and CISA KEV for changes in exploitation status
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows Direct Composition
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation more likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5127648, KB5126651, KB5126655, KB5126657, KB5126646, KB5126653
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-83896 msrc.microsoft.com
- NVD record for CVE-2026-83896 (Vulners mirror) vulners.com
- OpenCVE: CVE-2026-83896 app.opencve.io
- CVEList record for CVE-2026-83896 (Vulners) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:38.
Original description (NVD)
Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.