Microsoft Windows Installer: Elevation of privilege via heap-based buffer overflow

Summary

A heap-based buffer overflow in Windows Installer allows an authorized local attacker to elevate privileges to a higher level, with high impact on confidentiality, integrity and availability. The attacker needs local access and low privileges, and no user interaction is required. The flaw is not remotely exploitable, but it matters once an attacker already has a foothold on a device, for example through phishing or stolen credentials.

Affected

• Windows 10 Version 1607 (Windows 10 Enterprise LTSB 2016): builds below 10.0.14393.9612
• Windows Server 2016: builds below 10.0.14393.9612
• Windows 10 Version 1809: builds below 10.0.17763.9376
• Windows 10 Version 21H2 and 22H2: builds below 10.0.19045.7807
• Windows 11 Version 23H2: builds below 10.0.22631.7652
• Windows 11 Version 24H2, 25H2 and 26H2: builds below 10.0.26100.9711 (24H2), 10.0.26200.9711 (25H2) and 10.0.26300.9711 (26H2)
• Windows 11 Version 26H1: builds below 10.0.28000.3231
• Windows Server 2012 and 2012 R2 (including Server Core): builds below 6.2.9200.26434 and 6.3.9600.23470

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: KB5126868 (OS Build 14393.9612), released 13 Oct 2026
• Other products: fixed builds as listed under affected, from the October 2026 security updates
• Microsoft's release information also lists an out-of-band update with build 14393.9615 (26 Oct 2026). It is not confirmed that this build is required for this CVE.

Workaround

Unknown. No workaround or mitigation was found in the sources reviewed. Check the MSRC update guide for workaround information.

Exploitation

• No evidence of exploitation in the wild found.
• CISA SSVC: exploitation none, automatable no.
• Not listed in CISA's Known Exploited Vulnerabilities catalogue.
• EPSS score 0.00318 (very low).
• No public proof of concept found; this does not rule one out.

Our recommendation

• Inventory all Windows 10 1607 LTSB and Windows Server 2016 hosts now.
• Windows 10 1607 LTSB has reached end of updates and Microsoft states it receives no further security updates; the status of the out-of-band build is unclear. Plan migration, for example to Windows 11 Enterprise LTSC 2024, or isolate these devices and restrict local logons.
• Install the October 2026 cumulative updates on all other supported Windows versions.
• Limit local administrator rights and monitor for signs of privilege escalation.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-85366 msrc.microsoft.com
• NVD record mirror (Vulners): CVE-2026-85366 vulners.com
• KB5126868: Windows 10 1607 security update support.microsoft.com
• Windows 10 1607 and Windows Server 2016 release health status learn.microsoft.com
• Windows release information learn.microsoft.com
• OpenCVE: CVE-2026-85366 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:16.