Microsoft Windows: RPC Runtime remote code execution vulnerability

Summary

The Windows RPC Runtime Library contains an untrusted pointer dereference that allows an unauthorized attacker to execute code. The CNA describes the attack as network-based. The CVSS vector (UI:R) indicates that a user must interact, and the vendor snippet we could access describes a specially crafted file, so exposure depends on how RPC services and user file handling are reachable. Attack conditions are not fully confirmed.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9711)
• Windows Server 2012 and Server Core (6.2.9200.0 to before 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core (6.3.9600.0 to before 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 to before 10.0.14393.9612)

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: build 10.0.14393.9612 (per CNA data; KB number unknown)
• Other versions: see the fixed builds listed on the MSRC advisory
• Windows 10 Version 22H2 build value in some third-party tables appears to be a typo and must be checked on MSRC

Workaround

Unknown.

Exploitation

• No evidence of exploitation in the wild found.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• VulDB: not in CISA KEV; EPSS 0.00000 (may be stale).
• No public proof of concept found.

Our recommendation

• Patch affected Windows systems with the October 2026 security update, starting with servers and systems reachable from untrusted networks.
• Confirm the KB number and fixed build for your Windows version on the MSRC advisory before rollout.
• Block inbound RPC ports at the perimeter and restrict RPC to internal networks.
• Warn users not to open unexpected email attachments or files until patched.
• Check whether any Windows 10 Version 1607 systems are still in use and confirm their support end date with Microsoft, as the patch may not cover them after end of support.
• Monitor for unusual RPC traffic and code execution on endpoints and servers.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide (CVE-2026-88219) msrc.microsoft.com
• Vulners CVE record (CNA version data) vulners.com
• Strix CVE record (version table, CVSS, CWE) www.strix.ai
• VulDB CVE-2026-88219 (KEV, EPSS, CWE) vuldb.com
• EUVD-2026-100334 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 17:58.