Microsoft Windows Kernel: Out-of-bounds write enables local privilege escalation

Summary

An out-of-bounds write in the Windows kernel allows an authorized local user to elevate privileges. The attack requires local access with low privileges and no user interaction, so the vulnerability is not internet-facing. Successful exploitation can fully compromise the affected machine. The affected Windows 10, Windows 11 and Windows Server editions are listed below.

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9688)
• Windows 10 Version 1809 (builds before 10.0.17763.9487)
• Windows 10 Version 21H2 (builds before 10.0.19044.7846)
• Windows 10 Version 22H2 (builds before 10.0.19045.7846)
• Windows 11 Version 23H2 (builds before 10.0.22631.7711)
• Windows 11 Version 24H2 (builds before 10.0.26100.9974)
• Windows 11 Version 25H2 (builds before 10.0.26200.9974)
• Windows 11 Version 26H1 (builds before 10.0.28000.3501)
• Windows 11 Version 26H2 (builds before 10.0.26300.9974)
• Windows Server 2016, including Server Core (builds before 10.0.14393.9688)
• Windows Server 2019, including Server Core (builds before 10.0.17763.9487)
• Windows Server 2022 (builds before 10.0.20348.5870)
• Windows Server 2025: not listed in the CNA record; a third-party source names 10.0.26100.33822 (unverified)

Fixed in

• Install the security update that provides the builds listed above or later.
• KB number: Unknown. Take it from the MSRC advisory.
• A third-party page links KB5131096 to a Windows 10 21H2 update, but does not confirm it for this CVE.
• Third-party databases show a possible duplicate ID, CVE-2026-70303. Confirm in MSRC which ID carries the fix.

Workaround

Unknown. No vendor workaround is known.

• Until patched, restrict local logon on affected systems and apply the principle of least privilege.
• Monitor endpoints for privilege escalation.

Exploitation

Unknown at publication. The CNA marks exploitation as unproven (E:U), and CISA SSVC lists exploitation as none and not automatable. No KEV listing or public proof of concept was found, but this is not confirmed absence.

Our recommendation

• Inventory all Windows 10, Windows 11 and Windows Server systems and compare their builds with the list above.
• Prioritise systems on end-of-life builds (1607, 1809) and on builds that need Extended Security Updates (21H2, 22H2), and check ESU enrolment.
• Install the update from the MSRC advisory and verify the build number afterwards.
• Until then, limit local logon and monitor for privilege escalation.
• Escalate if Microsoft marks the vulnerability as exploited or publicly disclosed, or if CISA adds it to the KEV catalogue.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Security Update Guide (MSRC advisory) msrc.microsoft.com
• CVE record (CNA: Microsoft) www.cve.org
• Strix: affected builds (third-party) www.strix.ai
• KB5131096 (third-party, unverified mapping) senserva.com
• Vulners PT-2026-112386 (ID mapping check) vulners.com
• Strix: CVE-2026-70303 (possible duplicate) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 02:47.