Microsoft Windows Fax and Scan Service: Elevation of privilege via heap overflow

Summary

A heap-based buffer overflow (CWE-122) in the Windows Fax and Scan Service allows an attacker with a low-privileged local account to elevate privileges to a higher level. No user interaction is required, but the attacker must already be able to run code on the affected system. Microsoft rates the flaw Important with a CVSS 3.1 base score of 7.8.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to < 10.0.14393.9512)
• Windows 10 Version 1809 (10.0.17763.0 to < 10.0.17763.9245)
• Windows 10 Version 21H2 (10.0.19044.0 to < 10.0.19044.7725)
• Windows 10 Version 22H2 (10.0.19045.0 to < 10.0.19045.7725)
• Windows 11 Version 23H2 (10.0.22631.0 to < 10.0.22631.7582)
• Windows 11 Version 24H2 (10.0.26100.0 to < 10.0.26100.9445)
• Windows 11 Version 25H2 (10.0.26200.0 to < 10.0.26200.9445)
• Windows 11 Version 26H1 (10.0.28000.0 to < 10.0.28000.2954)
• Windows Server 2012 and 2012 R2, including Server Core (6.2.9200.0 to < 6.2.9200.26349; 6.3.9600.0 to < 6.3.9600.23398)
• Windows Server 2016, including Server Core (10.0.14393.0 to < 10.0.14393.9512)

Note: the CPE in the CVE record lists only Windows 10 1607, but the Microsoft advisory covers the products above.

Fixed in

• Install the Microsoft security update for each affected product that brings the build to or above the listed version (for example 10.0.14393.9512 for Windows 10 1607 and Server 2016, 10.0.17763.9245 for Windows 10 1809).
• Exact KB numbers are listed on the MSRC advisory page; the build numbers above were taken from the CVE record and third-party mirrors and should be checked there.

Workaround

Unknown. Microsoft has not confirmed an official workaround in the sources reviewed. Disabling the Windows Fax and Scan Service where fax and scan functions are not needed reduces the attack surface; this is generic advice and not confirmed by Microsoft.

Exploitation

• Publicly disclosed: No.
• Exploited: No.
• No public proof of concept or CISA KEV entry found as of 2 November 2026.
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Apply the Microsoft security update from 13 October 2026 to all affected Windows systems and prioritise multi-user PCs, terminal servers and shared workstations.
• Check the asset inventory for Windows 10 1607 systems; verify their end-of-support status on Microsoft's lifecycle page and plan an upgrade if support has ended.
• Where fax and scan functions are not used, consider disabling the service as an interim measure.
• Monitor for signs of local privilege escalation and review the CISA KEV catalogue and the MSRC page for changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft MSRC advisory msrc.microsoft.com
• OpenCVE app.opencve.io
• Vulners (MS record) vulners.com
• Vulners (CVELIST record) vulners.com
• Strix www.strix.ai
• OffSeq Radar radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:36.