Windows 10 1607: Heap-based buffer overflow in TCP/IP enables privilege escalation

Summary

A heap-based buffer overflow in the Windows TCP/IP stack allows an authorized local user to elevate privileges to SYSTEM. Exploitation requires local access with a low-privileged account, so the flaw is not directly reachable from the internet. Microsoft rates it as High (CVSS 3.1 7.8), and no exploitation or public proof-of-concept code is known.

Affected

• Windows 10 Version 1607 (builds 10.0.14393.0 before 10.0.14393.9612)
• Windows 10 Version 1809 (builds before 10.0.17763.9376)
• Windows 10 Version 21H2 (builds before 10.0.19044.7807)
• Windows 10 Version 22H2 (builds before 10.0.19045.7807)
• Windows 11 Version 23H2 (builds before 10.0.22631.7652)
• Windows 11 Version 24H2 (builds before 10.0.26100.9711)
• Windows 11 Version 25H2 (builds before 10.0.26200.9711)
• Windows 11 Version 26H1 (builds before 10.0.28000.3231)
• Windows 11 Version 26H2 (builds before 10.0.26300.9711)
• Windows Server 2012 and Server Core (builds before 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core (builds before 6.3.9600.23470)
• Windows Server 2016 (builds before 10.0.14393.9612)

Fixed in

• Windows 10 Version 1607: build 10.0.14393.9612 or later
• Windows 10 Version 1809: build 10.0.17763.9376 or later
• Windows 10 Version 21H2: build 10.0.19044.7807 or later
• Windows 10 Version 22H2: build 10.0.19045.7807 or later
• Windows 11 Version 23H2: build 10.0.22631.7652 or later
• Windows 11 Version 24H2 and 25H2, 26H2: build 10.0.26100.9711, 10.0.26200.9711 or 10.0.26300.9711 or later
• Windows 11 Version 26H1: build 10.0.28000.3231 or later
• Windows Server 2012: build 6.2.9200.26434 or later
• Windows Server 2012 R2: build 6.3.9600.23470 or later
• Windows Server 2016: build 10.0.14393.9612 or later
• KB article numbers: Unknown.

Workaround

• Unknown. No vendor workaround was identified; check the MSRC advisory.
• For Windows 10 Version 1607 devices that cannot be patched, Extended Security Updates (ESU) are the practical route. Confirm prerequisites on Microsoft's ESU pages.

Exploitation

• No exploitation in the wild is known.
• No public proof-of-concept exploit was found.
• CISA SSVC data: Exploitation none, Automatable no, Technical Impact total.

Our recommendation

• Inventory all Windows 10 1607 devices (including x86) and all Windows Server 2012, 2012 R2 and 2016 systems.
• Install the fixed builds from the MSRC advisory. Windows 10 Enterprise LTSB 2016 reached end of support on 13 October 2026, so enrol unpatched 1607 devices in ESU or replace them.
• Restrict local logon and administrative rights on shared, kiosk, point-of-sale and HMI endpoints.
• Monitor endpoints for unexpected privilege changes and new local administrator accounts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-85368 msrc.microsoft.com
• NVD mirror on Vulners: CVE-2026-85368 vulners.com
• OpenCVE: CVE-2026-85368 app.opencve.io
• Microsoft Tech Community: Windows 10 2016 LTSB end of support techcommunity.microsoft.com
• heise: Windows 10 LTSB and Server 2016 support ends www.heise.de

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:15.