Microsoft Windows: Remote code execution via use-after-free in Microsoft XML

Summary

A use-after-free vulnerability in the Microsoft XML component of Windows allows an unauthorized attacker to execute code over a network. The CVSS base score is 8.1 (High), but attack complexity is rated high. Exposure depends on whether systems parse untrusted XML from the network, for example through web services, mail or document handling.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (10.0.14393.0 before 10.0.14393.9612)
• Windows 10 Version 1809 and Windows Server 2019 (10.0.17763.0 before 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 before 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 before 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 before 10.0.22631.7652)
• Windows 11 Version 24H2, 25H2 and 26H2 (10.0.26100.0 before 10.0.26100.9711; 10.0.26200.0 before 10.0.26200.9711; 10.0.26300.0 before 10.0.26300.9711)
• Windows 11 Version 26H1 (10.0.28000.0 before 10.0.28000.3231)
• Windows Server 2012 and 2012 R2, including Server Core installations (6.2.9200.0 before 6.2.9200.26434; 6.3.9600.0 before 6.3.9600.23470)

Fixed in

• Install the Microsoft security update for the affected build. Fixed builds per the CNA data: 10.0.14393.9612 (1607, Server 2016), 10.0.17763.9376 (1809, Server 2019), 10.0.19044.7807 (21H2), 10.0.19045.7807 (22H2), 10.0.22631.7652 (23H2), 10.0.26100.9711 (24H2), 10.0.26200.9711 (25H2), 10.0.26300.9711 (26H2), 10.0.28000.3231 (26H1), 6.2.9200.26434 (Server 2012), 6.3.9600.23470 (Server 2012 R2).
• Fixes for Windows 10 1607 and Server 2016 were not confirmed; verify the KB number in the MSRC Security Update Guide.
• Windows Server 2012 and 2012 R2 fixed builds are listed by the CNA data only; verify against the MSRC page.

Workaround

• Unknown. One aggregator suggests restricting or disabling XML parsing services or enforcing group-policy restrictions if patching must be delayed. This could not be verified against the vendor advisory.
• Test any such restriction first, because disabling XML parsing can break applications.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total.
• Not listed in the CISA KEV catalog.
• EPSS is below 1 percent (about 0.7 to 0.8 percent).
• No public proof of concept found in the research; this does not prove none exists.
• Conflict: a ZDI review groups this CVE with bugs requiring a local authorized attacker, which contradicts the NVD description. Treat the network-exploitable reading as the conservative assumption until the MSRC advisory is checked.

Our recommendation

• Patch as a priority, starting with internet-facing servers and any system running Windows 10 1607, 1809 or 21H2 or Windows Server 2012, 2012 R2 or 2016.
• Check Microsoft lifecycle and ESU status for older branches before planning the update.
• Confirm installed builds against the fixed versions listed above.
• Identify systems and applications that parse XML from untrusted network sources and monitor them for abnormal crashes or code execution.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83914 msrc.microsoft.com
• OpenCVE: CVE-2026-83914 app.opencve.io
• Vulners Microsoft mirror: MS:CVE-2026-83914 vulners.com
• Vulners NVD mirror: NVD:CVE-2026-83914 vulners.com
• Vulners Rapid7 mirror (EPSS): RAPID7:CVE-2026-83914 vulners.com
• Zero Day Initiative: October 2026 Security Update Review www.zerodayinitiative.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:24.