Windows 10 1607: Heap-based buffer overflow in NTFS enables privilege escalation
Summary
A heap-based buffer overflow in the Windows NTFS file system driver allows a local attacker with low privileges to escalate to SYSTEM level. The attacker needs an existing foothold on the device, such as a phished user session or malware, so the risk is mainly post-compromise. The CVSS score is 7.8 (High), and Microsoft rates the technical impact as total.
Affected
- Windows 10 Version 1607 (Windows 10 Enterprise / IoT Enterprise 2016 LTSB), builds 10.0.14393.0 to below 10.0.14393.9612 according to the CNA record
- Windows Server 2016 builds 10.0.14393.0 to below 10.0.14393.9612 according to the CNA record
- Note: the 32-bit scope and the fixed build should be verified on MSRC, as sources differ
Fixed in
- Update released on October 13, 2026 via the Microsoft Security Update Guide
- CNA record: build 10.0.14393.9612 or later for Windows 10 Version 1607 (to be verified on MSRC)
Workaround
Unknown.
- No Microsoft-documented mitigation found; installing the update is the only known remedy.
Exploitation
- No public proof-of-concept found.
- No CISA KEV listing found (not directly checked).
- CISA SSVC: exploitation none, not automatable, total technical impact.
- EPSS: 0.00318.
Our recommendation
- Inventory all Windows 10 1607 / LTSB 2016 devices and confirm build 14393 on each.
- Verify the October 2026 update status and the fixed build on MSRC, then patch affected devices.
- For devices that cannot be patched, plan migration or ESU and restrict local logon and untrusted code on them in the meantime.
- Monitor for public proof-of-concept or KEV listings.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows NTFS
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126657, KB5126655, KB5126653, KB5127648, KB5126646, KB5127646
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-96217 msrc.microsoft.com
- Zero Day Initiative: October 2026 Security Update Review www.zerodayinitiative.com
- VulDB: CVE-2026-96217 vuldb.com
- Vulners: CVELIST:CVE-2026-96217 vulners.com
- OpenCVE: CVE-2026-96217 app.opencve.io
- Vulners VulnRichment: CVE-2026-96217 vulners.com
- 4sysops: Windows 10 Enterprise LTSB 2016 end of support and ESU 4sysops.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:01.
Original description (NVD)
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.