Microsoft Windows: Winlogon elevation of privilege via heap-based buffer overflow

Summary

A heap-based buffer overflow in the Windows logon component Winlogon allows an attacker with a local, low-privileged account to elevate privileges. Successful exploitation can have high impact on confidentiality, integrity and availability. No user interaction is required, and the vulnerability is not reachable from the internet. Microsoft lists it as not exploited.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to < 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to < 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to < 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to < 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to < 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to < 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to < 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to < 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to < 10.0.26300.9711)
• Windows Server 2012 and Server Core installation (6.2.9200.0 to < 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core installation (6.3.9600.0 to < 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 to < 10.0.14393.9612)

Fixed in

• Windows 10 Version 1607: 10.0.14393.9612 or later
• Windows 10 Version 1809: 10.0.17763.9376 or later
• Windows 10 Version 21H2: 10.0.19044.7807 or later
• Windows 10 Version 22H2: 10.0.19045.7807 or later
• Windows 11 Version 23H2: 10.0.22631.7652 or later
• Windows 11 Version 24H2: 10.0.26100.9711 or later
• Windows 11 Version 25H2: 10.0.26200.9711 or later
• Windows 11 Version 26H1: 10.0.28000.3231 or later
• Windows 11 Version 26H2: 10.0.26300.9711 or later
• Windows Server 2012: 6.2.9200.26434 or later
• Windows Server 2012 R2: 6.3.9600.23470 or later
• Windows Server 2016: 10.0.14393.9612 or later
• The KB number is unknown; check the Microsoft Security Update Guide.

Workaround

Unknown. No vendor-documented workaround is known. Installing the security update is the remedy.

Exploitation

• Microsoft states the vulnerability is not exploited.
• Microsoft rates exploit code maturity as Unproven.
• EPSS score is very low (0.00318).
• No public proof-of-concept exploit was found in the research. This does not prove that none exists.
• CISA KEV listing: not verified.

Our recommendation

• Install the latest Microsoft security update on all affected Windows systems, prioritising Windows 10 Version 1607 and Windows Server 2012 to 2016.
• Check the lifecycle status of Windows 10 Version 1607 and Windows Server 2012 systems. Unsupported systems will not receive this or future fixes and should be upgraded.
• Restrict local logon on servers and limit local accounts to what is needed.
• Monitor for unusual privilege changes and new local administrator accounts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-87699 msrc.microsoft.com
• OpenCVE: CVE-2026-87699 app.opencve.io
• Vulners (CVE list): CVE-2026-87699 vulners.com
• OffSeq: CVE-2026-87699 Windows 10 1607 radar.offseq.com
• Strix: CVE-2026-87699 www.strix.ai
• Vulners (CIRCL): CVE-2026-87699 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:37.