Windows TCP/IP: Heap-based buffer overflow allows local privilege escalation

Summary

A heap-based buffer overflow in the Windows TCP/IP networking stack allows an attacker with a valid low-privilege local account to elevate privileges, potentially to SYSTEM. The attacker must already be logged on locally, so the flaw is not directly reachable from the internet. Its main risk is after an initial compromise, for example through phishing, malware or a stolen user login.

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9688)
• Windows 10 Version 1809 (builds before 10.0.17763.9487)
• Windows 10 Version 21H2 (builds before 10.0.19044.7846)
• Windows 10 Version 22H2 (builds before 10.0.19045.7846)
• Windows 11 Version 23H2 (builds before 10.0.22631.7711)
• Windows 11 Version 24H2 and 25H2 (builds before 10.0.26100.9974 and 10.0.26200.9974)
• Windows 11 Version 26H1 (builds before 10.0.28000.3501)
• Windows 11 Version 26H2 (builds before 10.0.26300.9974)
• Windows Server 2016 (builds before 10.0.14393.9688)
• Windows Server 2019 (builds before 10.0.17763.9487)
• Windows Server 2022 (builds before 10.0.20348.5870)
• Windows Server 2025: Unknown.

Fixed in

• Install the November 2026 cumulative update for your Windows version and build.
• Fixed builds per the CVE record: 10.0.14393.9688, 10.0.17763.9487, 10.0.19044.7846, 10.0.19045.7846, 10.0.22631.7711, 10.0.26100.9974, 10.0.26200.9974, 10.0.28000.3501, 10.0.26300.9974, 10.0.20348.5870.
• Exact KB numbers per product: Unknown. Check the MSRC advisory.

Workaround

Unknown. No mitigation has been published in the sources reviewed. Applying the security update is the fix.

Exploitation

• The CISA SSVC assessment lists exploitation as "none" and automatable as "no".
• The CVSS vector uses exploit code maturity "unproven", so no public exploit code was known at publication.
• No reports of exploitation in the wild or CISA KEV listing were found. This status may change.

Our recommendation

• Patch Windows 10, Windows 11 and Windows Server systems in the November 2026 update cycle, starting with terminal servers, file servers and other multi-user hosts.
• Confirm the exact KB per build on the MSRC advisory.
• Limit local logon rights on shared systems and apply least privilege.
• Keep EDR active and monitor for privilege escalation activity.
• Replace or upgrade Windows 10 1607 and 1809 systems if they are still in use, as they are older builds.
• Recheck NVD and MSRC over the next week for exploit reports or changes to the affected list.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-96102 msrc.microsoft.com
• CVE Record: CVE-2026-96102 www.cve.org
• Strix AI: CVE-2026-96102 (secondary, verify against MSRC) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 02:35.