Microsoft OpenSSH for Windows: Remote code execution via heap-based buffer overflow

Summary

A heap-based buffer overflow in OpenSSH for Windows, included in Windows 10, Windows 11 and Windows Server, allows an unauthorized attacker to execute code over the network. According to the CVSS vector, exploitation requires user interaction, for example a user connecting to a malicious SSH server. NVD rates the vulnerability 8.8 (high).

Affected

• Windows 10 Version 1809 (10.0.17763.0 to < 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to < 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to < 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to < 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to < 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to < 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to < 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to < 10.0.26300.9711)
• Windows Server 2019 incl. Server Core (10.0.17763.0 to < 10.0.17763.9376)
• Windows Server 2022 (10.0.20348.0 to < 10.0.20348.5761)
• Windows Server 2025 incl. Server Core (10.0.26100.0 to < 10.0.26100.33650)

Fixed in

• Fixed builds are the upper limits listed under affected versions (official CVE record).
• Patch names mentioned by a third party, not verified: KB5126651 (Windows 10 1809, Server 2019) and KB5126646 (Server 2025).
• Verify build numbers against the MSRC advisory before rollout.

Workaround

• No vendor workaround known.
• Interim measure (own recommendation, not from a source): restrict use of ssh.exe, scp.exe and sftp.exe to trusted hosts until patched.

Exploitation

• Not listed in CISA KEV. CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof of concept or confirmed in-the-wild exploitation found.
• Possible indicators (third-party guidance): ssh.exe, scp.exe or sftp.exe crashing right after connecting to a new server, or unexpected programs started by the SSH client.

Our recommendation

• Install the October 2026 security update on all affected Windows 10, Windows 11 and Windows Server systems.
• Prioritise admin workstations and jump hosts that connect to external or customer systems.
• Until patched, limit SSH client use to trusted hosts.
• Monitor for crashes of ssh.exe, scp.exe and sftp.exe and for unexpected child processes started by the SSH client.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-88157 msrc.microsoft.com
• OpenCVE: CVE-2026-88157 app.opencve.io
• Vulners: MS:CVE-2026-88157 vulners.com
• Hive Pro: Biggest Patch Tuesday ever, October 2026 (third-party analysis) www.hivepro.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:06.