Windows 10 1607: Heap-based buffer overflow in Windows Kernel-Mode Drivers

Summary

A heap-based buffer overflow in the Windows Kernel-Mode Drivers allows a local user with low privileges to elevate privileges to SYSTEM. Exploitation requires a local logon or code running as a standard user, and no user interaction. Windows 10 Version 1607 and Windows Server 2016 are no longer receiving security updates from Microsoft as of October 13, 2026, so this issue is likely to remain unpatched on those systems unless they are covered by an extension.

Affected

• Windows 10 Version 1607 (build 10.0.14393.0 before 10.0.14393.9612)
• Windows Server 2016 (build 10.0.14393.0 before 10.0.14393.9612)
• The CVE record also lists other Windows 10, Windows 11 and Windows Server 2012/2012 R2 branches, which are outside the scope of this entry.

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: build 10.0.14393.9612 via KB5126868 (October 13, 2026)
• A later out-of-band update KB5134123 (build 10.0.14393.9615, October 26, 2026) was released. Whether it changes the fix status of this CVE is unconfirmed.

Workaround

Unknown.

• No vendor workaround has been identified for this CVE.
• General controls that reduce risk: limit local and interactive logons, restrict local accounts, and enforce least privilege. These are not vendor-recommended fixes.

Exploitation

• Microsoft lists the CVE as not publicly disclosed and not exploited, with exploitability assessed as 'Less Likely'.
• Microsoft temporal CVSS is 6.8 with Exploit Code Maturity 'Unproven' (E:U).
• CISA SSVC: exploitation none, automatable no, technical impact total.
• EPSS is 0.00318.
• No public proof of concept or CISA KEV entry was found.

Our recommendation

• Inventory all Windows 10 1607 and Windows Server 2016 hosts.
• Check ESU eligibility. Without an extension, plan to migrate or isolate these systems, because no further fixes will be released.
• Where still in use, install KB5126868 (build 10.0.14393.9612) and check whether KB5134123 is required.
• Restrict local logons and local accounts on affected hosts, and monitor for privilege escalation activity.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC advisory CVE-2026-85871 msrc.microsoft.com
• KB5126868 Windows 10 1607 security update support.microsoft.com
• KB5134123 Windows 10 1607 update support.microsoft.com
• Windows 10 1607 and Windows Server 2016 lifecycle status learn.microsoft.com
• NVD record mirror CVE-2026-85871 vulners.com
• VulnCheck/CISA enrichment CVE-2026-85871 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:50.