Microsoft Windows SSTP: Heap-based buffer overflow allows local privilege escalation
Summary
A heap-based buffer overflow in the Windows Secure Socket Tunneling Protocol (SSTP) component lets an authorized local user elevate privileges to a higher level. The attack requires an existing low-privileged account or code already running on the machine, so it is not directly exploitable from the internet. Successful exploitation would give the attacker full control over confidentiality, integrity and availability of the affected system.
Affected
- Windows 10 Version 1607: before 10.0.14393.9612
- Windows 10 Version 1809: before 10.0.17763.9376
- Windows 10 Version 21H2: before 10.0.19044.7807
- Windows 10 Version 22H2: before 10.0.19045.7807
- Windows 11 Version 23H2: before 10.0.22631.7652
- Windows 11 Version 24H2: before 10.0.26100.9711
- Windows 11 Version 25H2: before 10.0.26200.9711
- Windows 11 Version 26H1: before 10.0.28000.3231
- Windows 11 Version 26H2: before 10.0.26300.9711
- Windows Server 2012 R2 (including Server Core): before 6.3.9600.23470
- Windows Server 2016 (including Server Core): before 10.0.14393.9612
- Windows Server 2019: before 10.0.17763.9376
Fixed in
- Security updates in Microsoft's October 2026 release, with the minimum builds listed above.
- KB5126868 is reported for Windows 10 1607 and Server 2016. Confirm against the MSRC table before rollout.
Workaround
- Unknown. No vendor workaround or mitigation was found. Patching is the only documented remedy.
Exploitation
- Microsoft lists the vulnerability as not exploited.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept found. Status unknown.
- EPSS is low, at about 0.34%.
Our recommendation
- Patch affected Windows systems with the October 2026 cumulative update. Verify the build number against MSRC.
- Treat systems running SSTP or RRAS VPN servers as high priority, because the component may be reachable from outside. Treat other systems as medium priority.
- Plan migration off Windows 10 1607 and Server 2016 where possible, as these builds are out of support except for LTSC or Extended Security Updates.
- Review accounts with local logon rights and monitor for signs of privilege escalation.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows Secure Socket Tunneling Protocol (SSTP)
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation more likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5127648, KB5126651, KB5126655, KB5126657, KB5126646, KB5126653
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Response Center: CVE-2026-88147 msrc.microsoft.com
- Strix AI: CVE-2026-88147 www.strix.ai
- Cyberexperts: October 2026 Patch Tuesday cyberexperts.com
- Action1: Patch Tuesday October 2026 www.action1.com
- The Backroom Tech: Microsoft October 2026 Patch Tuesday thebackroomtech.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:16.
Original description (NVD)
Heap-based buffer overflow in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.