Microsoft Windows: Heap-based buffer overflow in Volume Manager Extension Driver

Summary

A heap-based buffer overflow in the Windows Volume Manager Extension Driver, a kernel-level driver, affects several client and server editions of Windows from Windows 10 1607 to Windows 11 26H2 and Windows Server 2012 to 2016. Microsoft describes the flaw as allowing code execution, and the NVD score of 9.8 assumes network access without privileges or user interaction. Microsoft rates the severity as Important, and the network attack path has not been verified, so the remote label should be treated as unconfirmed.

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9612)
• Windows 10 Version 1809 (builds before 10.0.17763.9376)
• Windows 10 Version 21H2 and 22H2 (builds before 10.0.19045.7807)
• Windows 11 Version 23H2 (builds before 10.0.22631.7652)
• Windows 11 Version 24H2 and 25H2 (builds before 10.0.26100.9711 and 10.0.26200.9711)
• Windows 11 Version 26H1 (builds before 10.0.28000.3231)
• Windows 11 Version 26H2 (builds before 10.0.26300.9711)
• Windows Server 2012 and 2012 R2, including Server Core installations
• Windows Server 2016 (builds before 10.0.14393.9612)

Fixed in

• Security updates released on October 13, 2026 via Windows Update, as listed in the MSRC Security Update Guide.
• Fixed builds according to the CNA record: see the affected list above (the build number after the '<' sign is the first fixed build).
• Sources disagree on some fixed builds (Windows 10 22H2, Windows Server 2012 and 2025). Verify against the MSRC table before deployment.

Workaround

Unknown. No mitigation or workaround was found in the sources. Check the MSRC FAQ and mitigations section.

Exploitation

• Microsoft lists the vulnerability as not publicly disclosed and not exploited, with an exploitability assessment of 'Exploitation Less Likely'.
• VulDB reports no available exploit and no public technical details, but describes exploitation as easy and remote without authentication. This conflicts with Microsoft's assessment.
• No public proof of concept or exploitation in the wild was found.

Our recommendation

• Patch affected Windows systems as soon as possible, starting with internet-facing and other servers, since the driver is also present in Windows Server editions.
• Verify the exact fixed build for each system against the MSRC table before rollout.
• Plan the upgrade or replacement of Windows 10 1607 systems and check Microsoft's lifecycle page for its support end date.
• Monitor for proof-of-concept releases and exploitation reports, and review logs for unusual driver or kernel crashes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC advisory CVE-2026-85928 msrc.microsoft.com
• NVD data via Vulners mirror vulners.com
• OpenCVE CVE-2026-85928 app.opencve.io
• VulDB entry 419348 vuldb.com
• Strix CVE-2026-85928 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:25.