Windows PCI Bus Driver: Heap-based buffer overflow enables privilege escalation

Summary

A heap-based buffer overflow in the Windows PCI Bus Driver allows an authorized local user to elevate privileges. Affected are supported Windows 10, Windows 11 and Windows Server 2019, 2022 and 2025 systems. An attacker needs a local account with low privileges and no user interaction, and a successful attack can lead to full control of the affected machine. The vulnerability is not reachable directly from the internet.

Affected

• Windows 10 Version 1809 (build 10.0.17763.0 to < 10.0.17763.9376)
• Windows 10 Version 21H2 (build 10.0.19044.0 to < 10.0.19044.7807)
• Windows 10 Version 22H2 (build 10.0.19045.0 to < 10.0.19045.7807)
• Windows 11 Version 23H2 (build 10.0.22631.0 to < 10.0.22631.7652)
• Windows 11 Version 24H2 (build 10.0.26100.0 to < 10.0.26100.9711)
• Windows 11 Version 25H2 (build 10.0.26200.0 to < 10.0.26200.9711)
• Windows 11 Version 26H1 (build 10.0.28000.0 to < 10.0.28000.3231)
• Windows 11 Version 26H2 (build 10.0.26300.0 to < 10.0.26300.9711)
• Windows Server 2019 and Server Core installation (build 10.0.17763.0 to < 10.0.17763.9376)
• Windows Server 2022 (build 10.0.20348.0 to < 10.0.20348.5761)
• Windows Server 2025 and Server Core installation (build 10.0.26100.0 to < 10.0.26100.33650)

Fixed in

• Security updates released by Microsoft on October 13, 2026
• Fixed builds: Windows 10 1809 and Server 2019 10.0.17763.9376; Windows 10 21H2 10.0.19044.7807; Windows 10 22H2 10.0.19045.7807; Windows 11 23H2 10.0.22631.7652; Windows 11 24H2 10.0.26100.9711; Windows 11 25H2 10.0.26200.9711; Windows 11 26H1 10.0.28000.3231; Windows 11 26H2 10.0.26300.9711; Server 2022 10.0.20348.5761; Server 2025 10.0.26100.33650
• KB numbers per product: Unknown. Check the MSRC page.

Workaround

Unknown. No mitigation has been identified in the sources reviewed. Applying the security update is the fix.

Exploitation

• Microsoft: not publicly disclosed, not exploited, exploitability assessment "Exploitation Unlikely"
• CISA SSVC: exploitation none, automatable no, technical impact total
• No public proof of concept known
• Not listed in the CISA Known Exploited Vulnerabilities catalog
• EPSS about 0.3%

Our recommendation

• Install the October 2026 security update on all affected Windows 10, Windows 11 and Windows Server systems, prioritising Windows 10 1809, LTSC 2019 and Server 2019 hosts.
• Confirm the exact Windows edition and KB number for each system on the MSRC page, and verify your ESU or LTSC licence covers the patch.
• Until patched, restrict local interactive logon on servers and shared PCs, limit standard user accounts, and keep EDR active.
• Monitor for unusual privilege escalation or SYSTEM-level processes started by low-privilege accounts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-85915 msrc.microsoft.com
• NVD mirror: CVE-2026-85915 (Vulners) vulners.com
• OpenCVE: CVE-2026-85915 app.opencve.io
• VulDB: CVE-2026-85915 vuldb.com
• Vulnrichment (Vulners): CVE-2026-85915 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:44.