Windows: Heap-based buffer overflow in Storage Spaces Controller

Summary

A heap-based buffer overflow in the Windows Storage Spaces Controller allows an authorized local user to elevate privileges. An attacker needs an existing foothold on the system, such as a compromised user or service account, and low privileges. Successful exploitation can lead to full control of the affected host (CVSS 3.1: 7.8, High).

Affected

• Windows 10 Version 1607 (10.0.14393.0 to below 10.0.14393.9512)
• Windows 10 Version 1809 (10.0.17763.0 to below 10.0.17763.9245)
• Windows 10 Version 21H2 (10.0.19044.0 to below 10.0.19044.7725)
• Windows 10 Version 22H2 (10.0.19045.0 to below 10.0.19045.7725)
• Windows 11 Version 23H2 (10.0.22631.0 to below 10.0.22631.7582)
• Windows 11 Version 24H2 (10.0.26100.0 to below 10.0.26100.9445)
• Windows 11 Version 25H2 (10.0.26200.0 to below 10.0.26200.9445)
• Windows 11 Version 26H1 (10.0.28000.0 to below 10.0.28000.2954)
• Windows Server 2012 incl. Server Core (6.2.9200.0 to below 6.2.9200.26349)
• Windows Server 2012 R2 incl. Server Core (6.3.9600.0 to below 6.3.9600.23398)
• Windows Server 2016 incl. Server Core (10.0.14393.0 to below 10.0.14393.9512)

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: build 10.0.14393.9512 (per aggregator data, not yet confirmed against MSRC)
• Windows 10 Version 1809: build 10.0.17763.9245
• Windows 10 21H2 and 22H2: build 10.0.19045.7725 / 10.0.19044.7725
• Windows 11 23H2: build 10.0.22631.7582
• Windows 11 24H2 and 25H2: build 10.0.26100.9445 / 10.0.26200.9445
• Windows 11 26H1: build 10.0.28000.2954
• Windows Server 2012: build 6.2.9200.26349
• Windows Server 2012 R2: build 6.3.9600.23398
• KB number for Windows 10 1607 and Server 2016: Unknown. Check the MSRC Security Update Guide.

Workaround

Unknown. The CVE record lists no workaround. One unverified aggregator suggests disabling Storage Spaces, but this is not confirmed by a primary source. Test the impact on storage before disabling anything in production.

Exploitation

• No known exploitation in the wild found; not in CISA KEV; CISA SSVC rates exploitation as none.
• No public proof-of-concept code found in our searches. This is not a confirmed negative.
• Local attack vector only (AV:L); EPSS score 0.00245 (about 0.25% 30-day exploitation likelihood).

Our recommendation

• Check the MSRC advisory for the exact fixed build and KB number before deployment.
• Patch Windows 10 1607 and Server 2016 hosts first and confirm whether these systems are still supported.
• Install the September 2026 security update on all other affected Windows systems through normal patch management.
• Restrict local logon and protect privileged and service accounts to limit the foothold an attacker needs.
• Monitor for public proof-of-concept code or KEV listing and re-check in one week.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-87706 msrc.microsoft.com
• Strix: CVE-2026-87706 www.strix.ai
• Vulners: MSCVE MS:CVE-2026-87706 vulners.com
• Vulners: CIRCL CIRCL:CVE-2026-87706 vulners.com
• VulDB: vuln 419377 vuldb.com
• Vulners: VulnRichment CVE-2026-87706 vulners.com
• OffSeq Radar: CVE-2026-87706 radar.offseq.com
• OpenCVE: CVE-2026-87706 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:35.