Microsoft Windows: Heap-based buffer overflow in Desktop Window Manager

Summary

Desktop Window Manager, the Windows component that composes the desktop, contains a heap-based buffer overflow (CWE-122) that allows privilege escalation. The affected branches include Windows 10 Version 1809, 21H2 and 22H2, Windows 11 (23H2 to 26H2), and Windows Server 2019, 2022 and 2025. A local attacker with low privileges can exploit the flaw to gain SYSTEM privileges, which gives full control over the affected system. The attacker needs a local session on the machine, for example through a user account or malware that is already running.

Affected

• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9376
• Windows 10 Version 21H2: builds before 10.0.19044.7807
• Windows 10 Version 22H2: builds before 10.0.19045.7807 (the CNA record lists a 21H2 build here, which looks like a typo; verify in the MSRC table)
• Windows 11 Version 23H2: builds before 10.0.22631.7652
• Windows 11 Version 24H2: builds before 10.0.26100.9711
• Windows 11 Version 25H2: builds before 10.0.26200.9711
• Windows 11 Version 26H1: builds before 10.0.28000.3231
• Windows 11 Version 26H2: builds before 10.0.26300.9711
• Windows Server 2022: builds before 10.0.20348.5761
• Windows Server 2025 (including Server Core): builds before 10.0.26100.33650 (a third-party mirror lists a different value; verify in the MSRC table)

Fixed in

• Fixed in the October 2026 security updates. Per the CNA record: Windows 10 1809 and Server 2019 from 10.0.17763.9376; 21H2 from 10.0.19044.7807; Windows 11 23H2 from 10.0.22631.7652; 24H2 from 10.0.26100.9711; 25H2 from 10.0.26200.9711; 26H1 from 10.0.28000.3231; 26H2 from 10.0.26300.9711; Server 2022 from 10.0.20348.5761; Server 2025 from 10.0.26100.33650.
• Fixed build for 22H2: unclear in the sources; check the MSRC table.
• Knowledge base numbers reported by third parties (KB5126651 for 1809/Server 2019, KB5126646 for Server 2025) are not confirmed by Microsoft.

Workaround

Unknown. No documented workaround was found; install the security update.

Exploitation

• Microsoft states the vulnerability is not publicly disclosed and not known to be exploited.
• CISA SSVC: exploitation none, not automatable.
• Not listed in CISA KEV.
• EPSS below 1%.
• No public proof of concept found.
• A market estimate of the exploit price exists, but this is not evidence of in-the-wild use.

Our recommendation

• Install the October 2026 security update on all affected Windows 10, Windows 11 and Windows Server systems, starting with Windows 10 1809 and Server 2019, which are old and should be treated as high priority.
• Patch shared workstations, RDP and terminal servers, and systems where users open untrusted files or browser content first.
• Verify the fixed build for each system against the MSRC table, not only against third-party data.
• Check whether Windows 10 1809 is still within Microsoft's support lifecycle.
• Monitor for unusual privilege escalation on endpoints.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-88093 msrc.microsoft.com
• Vulners: CNA JSON for CVE-2026-88093 vulners.com
• VulDB: CVE-2026-88093 vuldb.com
• OpenCVE: CVE-2026-88093 app.opencve.io
• Qualys: Microsoft Patch Tuesday October 2026 blog.qualys.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:26.