Microsoft Windows MDM: Heap-based buffer overflow allows local privilege escalation

Summary

A heap-based buffer overflow in the Windows Modern Device Management (MDM) component allows an authorized local attacker to elevate privileges. An attacker needs a valid low-privileged user session on the device, and no user interaction is required. Successful exploitation could give full control over confidentiality, integrity and availability of the affected system.

Affected

• Windows 10 Version 1607 (10.0.14393.0 before 10.0.14393.9688)
• Windows 10 Version 1809 (10.0.17763.0 before 10.0.17763.9487)
• Windows 10 Version 21H2 (10.0.19044.0 before 10.0.19044.7846)
• Windows 10 Version 22H2 (10.0.19045.0 before 10.0.19045.7846)
• Windows 11 Version 23H2 (10.0.22631.0 before 10.0.22631.7711)
• Windows 11 Version 24H2 (10.0.26100.0 before 10.0.26100.9974)
• Windows 11 Version 25H2 (10.0.26200.0 before 10.0.26200.9974)
• Windows 11 Version 26H1 (10.0.28000.0 before 10.0.28000.3501)
• Windows 11 Version 26H2 (10.0.26300.0 before 10.0.26300.9974)
• Windows Server 2016, including Server Core (10.0.14393.0 before 10.0.14393.9688)
• Windows Server 2019, including Server Core (10.0.17763.0 before 10.0.17763.9487)
• Windows Server 2022 (10.0.20348.0 before 10.0.20348.5870)

Fixed in

Install the Microsoft security update for November 2026 for each product. The first fixed build per product is listed in the affected section (the version after 'before'). Confirm the KB number per product on the MSRC page.

Workaround

Unknown. No vendor workaround was found. Apply the security update instead of relying on mitigations.

Exploitation

• Microsoft rates exploit code maturity as Unproven (E:U) at publication.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• OffSeq lists it as not known to be exploited.
• No public proof of concept found.
• Status conflicts between sources and has not been confirmed for this CVE.

Our recommendation

• Compare the build of each Windows device (winver) with the fixed builds above and confirm the list on the MSRC page.
• Install the November 2026 cumulative update on all affected devices, starting with devices enrolled in MDM (e.g. Microsoft Intune) and any device still on Windows 10 1607 or 1809.
• Check the support status of older Windows 10 builds and Windows Server editions.
• Restrict standard-user rights and local accounts, and limit who can enrol devices in MDM.
• Monitor for unexpected MDM enrolment changes.
• Patch the other 2026 MDM elevation-of-privilege CVEs together with this one.
• Recheck the NVD entry once it is analysed.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-96184 msrc.microsoft.com
• CVE.org record CVE-2026-96184 www.cve.org
• OffSeq Radar: CVE-2026-96184 radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 02:26.