Windows 10 1607: Heap-based buffer overflow in WebDAV enables local privilege escalation

Summary

A heap-based buffer overflow in the Windows WebDAV component allows an authorized local user to elevate privileges. An attacker needs valid low-privileged access to the system but no user interaction, so this is a follow-on step after a foothold rather than a remote entry point. The CVSS 3.1 base score is 7.8 (High), with high impact on confidentiality, integrity and availability. It matters most on terminal servers, multi-user hosts and systems where a compromised user account is a realistic starting point.

Affected

• Windows 10 Version 1607: builds 10.0.14393.0 to below 10.0.14393.9612
• Windows Server 2016: builds 10.0.14393.0 to below 10.0.14393.9612 (secondary source, to be confirmed on MSRC)
• Other Windows 10, Windows 11 and Windows Server versions are also listed as affected in the CNA record, each with its own fixed build

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: October 2026 cumulative security update, build 10.0.14393.9612 or later (KB5126868 according to Tenable, to be confirmed on MSRC)
• Other affected versions: see the MSRC advisory for their fixed builds

Workaround

Unknown from the vendor. A third-party aggregator suggests disabling the WebDAV HTTP service (WebClient) if the functionality is not required. This has not been verified against the MSRC advisory.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total
• Not listed in the CISA KEV catalog
• No public proof of concept found in the research performed
• Microsoft's exploitation and public disclosure flags: unknown, check MSRC

Our recommendation

• Install the October 2026 security update for Windows 10 1607 and Windows Server 2016 (build 10.0.14393.9612 or later) as soon as possible.
• Check whether the systems are still supported; Windows 10 1607 is an old build and may be out of support, in which case replacement is the real fix.
• Disable the WebDAV/WebClient service on hosts that do not need it.
• Prioritise terminal servers and multi-user systems, and monitor for unusual local privilege changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-96843 msrc.microsoft.com
• CNA record and version data (Vulners CVELIST) vulners.com
• EUVD record with version ranges vulners.com
• Tenable plugin 365471 (October 2026 update for 1607) www.tenable.com
• OpenCVE record (NVD-derived data, SSVC, KEV) app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 00:48.