Windows 10 1607: Out-of-bounds read in BitLocker enables local privilege escalation
Summary
Windows 10 Version 1607 (and Windows Server 2016 per the CVE record) is affected by an out-of-bounds read in the Windows BitLocker full-disk encryption feature. A local user with low privileges can exploit it to elevate their privileges, with a CVSS base score of 7.8. The attack requires an existing foothold on the system, such as a low-privileged account or malware, and no user interaction.
Affected
- Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9612
- Windows Server 2016: 10.0.14393.0 to before 10.0.14393.9612 (listed in the CVE record, to be confirmed on the MSRC page)
Fixed in
- Windows 10 Version 1607 (x64): build 10.0.14393.9612 or later, included in the October 2026 security updates
- KB number for Windows 10 1607: Unknown. Please take it from the MSRC page.
Workaround
Unknown. No workaround was found in the sources. Installing the October 2026 update is the fix.
Exploitation
- Not listed in CISA KEV.
- EPSS below 1%.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept known.
Our recommendation
- Install the October 2026 security update for Windows 10 1607 and Windows Server 2016 as soon as possible. Get the exact KB number from the MSRC page.
- Prioritise shared or multi-user Windows 10 1607 systems and endpoints where phishing or malware is plausible.
- Check whether your edition (LTSB/LTSC) still receives security updates on Microsoft's lifecycle page. Windows 10 1607 is an old build, so plan an upgrade.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows BitLocker
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126835, KB5126836, KB5126868, KB5126651, KB5126657, KB5126655
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-88070 msrc.microsoft.com
- OpenCVE: CVE-2026-88070 app.opencve.io
- Vulners: MS:CVE-2026-88070 vulners.com
- OffSeq Radar: CVE-2026-88070 (Windows 10 1607) radar.offseq.com
- Cybersecurity News: Windows BitLocker vulnerabilities cybersecuritynews.com
- VulDB: CVE-2026-88070 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:31.
Original description (NVD)
Out-of-bounds read in Windows BitLocker allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.