Microsoft Windows WMI: Heap-based buffer overflow allows local privilege escalation

Summary

A heap-based buffer overflow in Windows Management Instrumentation (WMI) allows an authorized, low-privilege user to elevate privileges locally on affected Windows 10, Windows 11 and Windows Server systems. The CVSS vector indicates a full impact on confidentiality, integrity and availability once the attacker has the local system. Exploitation requires a valid local account or an existing foothold on the machine, and the vector does not indicate remote exploitation.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): before 10.0.17763.9487
• Windows 10 Version 21H2: before 10.0.19044.7846
• Windows 10 Version 22H2: before 10.0.19045.7846
• Windows 11 Version 23H2: before 10.0.22631.7711
• Windows 11 Version 24H2: before 10.0.26100.9974
• Windows 11 Version 25H2 and 26H2: before 10.0.26200.9974 and 10.0.26300.9974
• Windows 11 Version 26H1: before 10.0.28000.3501
• Windows Server 2022: before 10.0.20348.5870

Fixed in

Security update of November 2026 (Patch Tuesday). Fixed builds as listed in the CVE record are shown under affected; the MSRC table should be checked for the exact build per device. Knowledge base numbers: only a third-party page lists KB5131096 for Windows 10 21H2, not confirmed by Microsoft. For other builds: Unknown.

Workaround

Unknown.

Exploitation

• No evidence of exploitation in the wild found.
• No public proof of concept found.
• Not found in the CISA KEV catalog.
• CISA SSVC: exploitation none, not automatable, total technical impact.

Our recommendation

• Install the November 2026 cumulative update on all affected systems, starting with terminal servers, file servers and administrator workstations.
• Verify the installed build against the MSRC security update guide for each device.
• Limit local logon rights on shared and multi-user hosts and enforce least privilege.
• Monitor for unusual WMI activity and new local administrator accounts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-95920 msrc.microsoft.com
• CVE Record CVE-2026-95920 (CVE.org) www.cve.org
• Qualys: Microsoft Patch Tuesday November 2026 review blog.qualys.com
• Senserva: KB5131096 (third-party, unconfirmed) senserva.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 03:01.