Microsoft Windows 10 1607: Local privilege escalation in Win32K GRFX

Summary

A heap-based buffer overflow in the Win32K GRFX (graphics) component of Windows 10 Version 1607 and Windows Server 2016 allows a local attacker with a low-privilege account to elevate privileges to a higher level. The attacker needs local access and an existing foothold, for example through malware or a malicious insider, so this is a post-compromise escalation step rather than an internet-facing entry point. Successful exploitation can affect confidentiality, integrity and availability of the system.

Affected

• Windows 10 Version 1607 (builds 10.0.14393.0 to below 10.0.14393.9612)
• Windows Server 2016 (builds 10.0.14393.0 to below 10.0.14393.9612)

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: build 10.0.14393.9612 or later, delivered by KB5126868 (released 13 Oct 2026)
• Whether KB5134123 (build 14393.9615, released 26 Oct 2026) adds coverage for this CVE is unverified.

Workaround

• No CVE-specific workaround is known. Patching is the only fix in the sources.
• Enforcing least-privilege policies on local user accounts reduces impact but does not remove the flaw.

Exploitation

• MSRC at publication: publicly disclosed No, exploited No, exploitability assessment 'Exploitation More Likely'.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof of concept, exploitation in the wild or CISA KEV entry was found as of 2 Nov 2026.
• EPSS score: 0.00369.

Our recommendation

• Inventory all Windows 10 1607 and Windows Server 2016 hosts and confirm build 10.0.14393.9612 or later.
• Apply KB5126868 or a later cumulative update to all affected systems; check the release-health page for further updates, as Windows 10 Enterprise LTSB 2016 reached end of updates on 13 Oct 2026.
• Plan a supported OS upgrade for any system that cannot be patched, such as legacy line-of-business, POS or industrial hosts.
• Limit local interactive logons and administrative rights, and keep EDR monitoring active.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-85901 msrc.microsoft.com
• Microsoft KB5126868: Windows 10 1607 security update support.microsoft.com
• Microsoft KB5134123: Windows 10 1607 update support.microsoft.com
• Microsoft release health: Windows 10 1607 and Windows Server 2016 status learn.microsoft.com
• OpenCVE: CVE-2026-85901 app.opencve.io
• VulnRichment: CVE-2026-85901 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:47.