Windows Camera Frame Server Monitor: Heap overflow allows local privilege escalation

Summary

A heap-based buffer overflow in the Windows Camera Frame Server Monitor service allows an attacker who already has access to a low-privileged account on the host to elevate privileges. The attack must be carried out locally and requires valid user credentials, but no user interaction. Successful exploitation can give the attacker full control over the affected system (high impact on confidentiality, integrity and availability).

Affected

• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
• Windows Server 2019 (including Server Core): 10.0.17763.0 to before 10.0.17763.9487
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870
• Windows Server 2025 (including Server Core): 10.0.26100.0 to before 10.0.26100.33822

Note: The Windows 11 and Server build ranges were taken from a secondary source and not yet verified against MSRC.

Fixed in

• Install the security update released by Microsoft for the affected versions (build numbers as listed above).
• KB article numbers: Unknown.

Workaround

Unknown. No workaround is documented in the sources reviewed. A third-party source suggests disabling the Windows Camera Frame Server service where camera functions are not needed; this is not a Microsoft recommendation for this CVE.

Exploitation

• No public exploit code is known at publication (CVSS temporal metric E:U).
• No evidence of exploitation in the wild was found.
• Microsoft's exploitation-detected flag: Unknown.
• CISA SSVC: Exploitation none, automatable no, technical impact total.

Our recommendation

• Patch affected Windows 10, 11 and Server systems with the Microsoft security update as soon as possible, prioritising multi-user workstations and terminal or shared servers.
• Verify the fixed build numbers against the MSRC advisory before rollout.
• On servers without camera use, consider disabling the Windows Camera Frame Server service after testing.
• Check whether Windows 10 systems still have ESU coverage or an upgrade path.
• Monitor for unusual privilege escalation activity on endpoints.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record CVE-2026-85942 (Microsoft CNA) www.cve.org
• Microsoft Security Update Guide CVE-2026-85942 msrc.microsoft.com
• Strix CVE-2026-85942 (secondary, verify) www.strix.ai
• SentinelOne vulnerability database (sibling CVE, component description) www.sentinelone.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 03:22.