Windows Internet (wininet.dll): Information disclosure through out-of-bounds read

Summary

An out-of-bounds read in the Windows Internet library wininet.dll allows an authorized local user to read memory outside the intended buffer and disclose information. The attacker needs a local foothold and valid low-privilege credentials, and the attack is considered highly complex. Only confidentiality is affected, with no integrity or availability impact.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): 10.0.14393.0 to before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): 10.0.17763.0 to before 10.0.17763.9487
• Windows 10 Version 21H2 and 22H2: 10.0.19044.0 to before 10.0.19044.7846 and 10.0.19045.0 to before 10.0.19045.7846 (CVE record)
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2 and 25H2: 10.0.26100.0 to before 10.0.26100.9974 and 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870

Fixed in

• Windows 10 Version 1607 / Server 2016: security update with build 10.0.14393.9688 or later (CVE record)
• Windows 10 Version 1809 / Server 2019: security update with build 10.0.17763.9487 or later (CVE record)
• Other listed products: fixed build not confirmed in the reviewed sources; check the MSRC Security Update Guide for the build per product
• Secondary sources give conflicting build numbers, which are not used here

Workaround

Unknown. No workaround or mitigation has been published.

Exploitation

• Not known to be exploited in the wild; not listed in CISA KEV
• CISA SSVC: exploitation none, automatable no, technical impact partial
• Rapid7 rates exploitation as less likely and reports no public disclosure
• No public proof of concept known

Our recommendation

• Install the November 2026 Windows security update on all affected systems, verifying the fixed build on the MSRC page
• Prioritize multi-user systems, terminal servers and shared workstations
• Ensure ESU enrolment is active on any Windows 10 host covered only by ESU
• Treat this as a standard monthly patch, not an emergency rollout, unless combined with another exploit chain
• Restrict local logon and limit untrusted code execution on shared systems

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-96093 msrc.microsoft.com
• CVE.org record CVE-2026-96093 www.cve.org
• Rapid7: Patch Tuesday November 2026 www.rapid7.com
• Senserva: KB5131090 senserva.com
• strix.ai: CVE-2026-96093 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:16.