Microsoft Windows: Heap-based buffer overflow in UI Immersive Server API

Summary

A heap-based buffer overflow in the Windows UI Immersive Server API allows an attacker with local, low-privilege access to elevate privileges on the affected system. The CVSS vector has a changed scope (S:C), so the impact can reach beyond the vulnerable component. Exploitation requires a local, authenticated user and is not possible over the network. Microsoft rates the severity as Important and reports no public disclosure.

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9612)
• Windows 10 Version 1809 (builds before 10.0.17763.9376)
• Windows 10 Version 21H2 (builds before 10.0.19044.7807)
• Windows 10 Version 22H2 (builds before 10.0.19045.7807)
• Windows 11 Version 23H2 (builds before 10.0.22631.7652)
• Windows 11 Version 24H2 (builds before 10.0.26100.9711)
• Windows 11 Version 25H2 (builds before 10.0.26200.9711)
• Windows 11 Version 26H1 (builds before 10.0.28000.3231)
• Windows 11 Version 26H2 (builds before 10.0.26300.9711)
• Windows Server 2012 and Server Core installation (builds before 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core installation (builds before 6.3.9600.23470)
• Windows Server 2016 (builds before 10.0.14393.9612)

Note: The CPE in NVD lists only Windows 10 1607. Use the MSRC table as the authoritative list.

Fixed in

• Install the October 2026 Microsoft security update for each affected build (fixed builds as listed in the affected section).
• Exact KB numbers: see the MSRC advisory. Secondary sources cite KB5126651 (Windows 10 1809 / Server 2019) and KB5126646 (Server 2025); these were not verified against MSRC.
• Secondary sources disagree on some fixed builds (for example Windows 11 24H2). Confirm per product in the MSRC table.

Workaround

Unknown.

Exploitation

• Publicly disclosed: No (per Microsoft).
• Exploit code maturity: unproven (temporal vector E:U).
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• EPSS score is low (0.00318).
• No public proof-of-concept found in searches. CISA KEV status not confirmed in the research; check the catalog directly.

Our recommendation

• Patch all affected Windows systems in the October 2026 cycle, starting with multi-user systems such as terminal servers (RDS), shared workstations and kiosks.
• Check whether any Windows 10 1607 or Server 2016 systems remain and confirm their support status with Microsoft's lifecycle pages.
• Where patching is delayed, restrict local logon to trusted users and monitor privileged activity.
• Verify the exact fixed build per product in the MSRC advisory before rollout.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-85905 msrc.microsoft.com
• Vulners NVD mirror: CVE-2026-85905 vulners.com
• Vulners VulnCheck/EPSS data: CVE-2026-85905 vulners.com
• Strix AI mirror: CVE-2026-85905 www.strix.ai
• OpenCVE: CVE-2026-85905 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:18.