Windows exFAT File System: Heap-based buffer overflow enables local privilege escalation

Summary

A heap-based buffer overflow in the Windows exFAT File System driver allows an authenticated local attacker to elevate privileges, potentially to SYSTEM. The attacker needs low privileges and no user interaction. Systems where users can mount exFAT removable media or where several users log on locally are most exposed. The CVSS base score is 7.8 (High).

Affected

• Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9711
• Windows Server 2012 (including Server Core): 6.2.9200.0 to before 6.2.9200.26434
• Windows Server 2012 R2 (including Server Core): 6.3.9600.0 to before 6.3.9600.23470
• Windows Server 2016: 10.0.14393.0 to before 10.0.14393.9612

Fixed in

• Install the Microsoft security update for the affected edition. Fixed builds are the versions listed as the upper bound above.
• KB numbers: Unknown. Confirm them in the MSRC Security Update Guide.
• Windows 10 Version 1607 LTSB may have reached end of support on 13 Oct 2026. Check the Microsoft lifecycle page. If support has ended, no fix may be available.

Workaround

• No vendor-confirmed workaround found.
• A third-party source suggests disabling or removing exFAT support on systems that do not need it, if patching is not possible. Check with Microsoft whether this is supported and what it affects before using it.
• General measure: restrict the use of USB and removable media and limit local logon on shared systems.

Exploitation

• CISA KEV: not listed.
• EPSS: below 1 percent (very low).
• CISA SSVC: exploitation none, not automatable, total technical impact.
• No public proof-of-concept exploit found.
• Exploit market price estimate of USD 5,000 to 25,000 from VulDB. This is an estimate, not evidence of use.

Our recommendation

• Patch affected Windows systems with the current Microsoft security update as a priority, especially shared PCs, terminal and RDS servers, and kiosks.
• Replace Windows 10 Version 1607 systems if their lifecycle has ended and no fix is available.
• Restrict or monitor the use of USB and SD media and limit local logon on multi-user systems.
• Inventory exFAT exposure and re-check KEV and EPSS status in the coming weeks.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-85822 msrc.microsoft.com
• Vulners: CVE-2026-85822 vulners.com
• OpenCVE: CVE-2026-85822 app.opencve.io
• VulDB: vuln 419240 vuldb.com
• Strix: CVE-2026-85822 www.strix.ai
• Vulners MSCVE: MS:CVE-2026-85822 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:06.