Windows 10 1607: Group Policy heap overflow allows local privilege escalation
Summary
A heap-based buffer overflow in the Windows Group Policy component affects Windows 10 Version 1607 and Windows Server 2016. A local user with low privileges can exploit it to gain higher privileges on the affected system. An attacker needs an existing local logon and cannot exploit the flaw remotely, so it is a privilege-escalation step rather than an entry point.
Affected
- Windows 10 Version 1607 builds below 10.0.14393.9612
- Windows Server 2016 builds below 10.0.14393.9612
- Other Windows branches are listed in the CVE record and on the MSRC page.
Fixed in
- Windows 10 Version 1607 and Windows Server 2016: build 10.0.14393.9612 or later
- KB number for the 1607 update: Unknown (confirm on the MSRC page)
Workaround
- Unknown. No vendor workaround was found.
- General interim measure: restrict local interactive logons on affected machines to the minimum number of accounts and remove unneeded local admin rights.
Exploitation
- CISA SSVC: Exploitation none, Automatable no
- Not listed in the CISA KEV catalogue
- EPSS about 0.3 percent
- No public proof of concept or in-the-wild exploitation found; this means nothing is known, not that exploitation is confirmed absent
Our recommendation
- Inventory all Windows 10 1607 and Windows Server 2016 systems.
- Confirm the KB number on the MSRC page and install build 10.0.14393.9612 or later.
- Prioritise shared, multi-user, kiosk and terminal systems where untrusted people can log on locally.
- Plan a migration if the operating system is out of support.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows Group Policy
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126651, KB5126655, KB5126657, KB5126646, KB5127648, KB5126653
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-83932 msrc.microsoft.com
- OpenCVE: CVE-2026-83932 app.opencve.io
- Vulners NVD: CVE-2026-83932 vulners.com
- Vulners Microsoft: MS:CVE-2026-83932 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:32.
Original description (NVD)
Heap-based buffer overflow in Windows Group Policy allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.