Windows Remote Access Connection Manager: Local privilege escalation via heap overflow

Summary

A heap-based buffer overflow in the Windows Remote Access Connection Manager component allows an authorized local user with low privileges to elevate their privileges. Microsoft rates the flaw at CVSS 3.1 7.8 (High). Exploitation requires a valid local account and is not directly reachable from the internet. Microsoft has released fixes for the affected builds.

Affected

• Windows 10 Version 1607 and Windows Server 2016: builds 10.0.14393.0 to before 10.0.14393.9612
• Windows 10 Version 1809 and Windows Server 2019: builds 10.0.17763.0 to before 10.0.17763.9376
• Windows 10 Version 21H2: builds 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: builds 10.0.19045.0 to before 10.0.19045.7807
• Windows 11 Version 23H2: builds 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2: builds 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 Version 25H2: builds 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 Version 26H1: builds 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 Version 26H2: builds 10.0.26300.0 to before 10.0.26300.9711
• Windows Server 2012 R2 (including Server Core): builds 6.3.9600.0 to before 6.3.9600.23470

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.9612
• Windows 10 Version 1809 and Windows Server 2019: 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.9711
• Windows Server 2012 R2: 6.3.9600.23470

KB numbers for Windows 10 Version 1607 are unknown.

Workaround

• No vendor workaround found.
• Interim measure (own assessment, not from a source): restrict local interactive logon and limit standard user accounts on affected systems.

Exploitation

• Exploitation in the wild: not confirmed. CISA SSVC: exploitation none, not automatable, total technical impact.
• Public exploit code: none found.
• A third-party Tenable plugin page lists this CVE with a Critical score, exploit availability and a KEV due date. These values do not match the NVD and MSRC data and remain unverified.

Our recommendation

• Inventory Windows systems and compare the exact builds with the fixed builds above.
• Install the October 2026 security update on affected systems, starting with systems reachable through RDP or VPN.
• Check whether Windows 10 Version 1607 still receives security updates. Replace or isolate such systems if they cannot be patched.
• Check the CISA KEV catalog and the MSRC exploitability information directly instead of relying on third-party data.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-85867 msrc.microsoft.com
• Vulners: NVD record CVE-2026-85867 vulners.com
• Vulners: Microsoft advisory MS:CVE-2026-85867 vulners.com
• Strix: CVE-2026-85867 www.strix.ai
• OpenCVE: CVE-2026-85867 app.opencve.io
• Microsoft 2026 CVEs customer risk cohort document cdn-dynmedia-1.microsoft.com
• Tenable plugin 365472 (conflicting data, unverified) www.tenable.com
• CVE.IMFHT intel record 846439 cve.imfht.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:54.