Microsoft Windows Kernel: Heap-based buffer overflow allows privilege escalation

Summary

A heap-based buffer overflow in the Windows kernel allows an unauthorized local attacker to elevate privileges, potentially to full control of the device. No existing account is required, but the attacker needs physical access to the device, for example a stolen, unattended or shared system. The CVSS 3.1 base score is 6.8 (medium), NVD analysis is still pending, and CISA SSVC lists no exploitation.

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9688)
• Windows 10 Version 1809 (builds before 10.0.17763.9487)
• Windows 10 Version 21H2 (builds before 10.0.19044.7846)
• Windows 10 Version 22H2 (builds before 10.0.19045.7846)
• Windows 11 Version 23H2 (builds before 10.0.22631.7711)
• Windows 11 Version 24H2 (builds before 10.0.26100.9974)
• Windows 11 Version 25H2 (builds before 10.0.26200.9974)
• Windows 11 Version 26H1 (builds before 10.0.28000.3501)
• Windows 11 Version 26H2 (builds before 10.0.26300.9974)
• Windows Server 2016, including Server Core (builds before 10.0.14393.9688)
• Windows Server 2019, including Server Core (builds before 10.0.17763.9487)
• Windows Server 2022 (builds before 10.0.20348.5870)

Fixed in

• Install the Microsoft security update for the affected Windows version that brings the build to the fixed build number listed above or later.
• The KB article number is unknown.

Workaround

• Unknown. No vendor workaround has been found.
• Restricting physical access and enabling BitLocker with TPM and PIN reduce the risk until patching is complete.

Exploitation

• No known exploitation in the wild.
• No public proof of concept found.
• CISA SSVC assessment: exploitation none, automatable no, technical impact total.

Our recommendation

• Identify all Windows 10 and Windows Server systems in scope and check whether they run one of the affected builds.
• Replace or upgrade Windows 10 systems that are out of support, because they will not receive this fix.
• Install the update in the normal monthly patch cycle, starting with laptops, shared devices and kiosks.
• Enable BitLocker with TPM and PIN, keep Secure Boot enabled and lock sessions when away.
• Monitor for public proof of concept code or a CISA KEV listing and re-check the NVD score.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-95905 msrc.microsoft.com
• CVE Record: CVE-2026-95905 www.cve.org
• Strix: CVE-2026-95905 (third-party summary) www.strix.ai
• CISA KEV alert of 13 October 2026 www.cisa.gov
• CISA: Reducing significant risk of known exploited vulnerabilities www.cisa.gov

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 10:32.