IT SBIT Services
Schneeberger
DEEN
CVE tracker

Microsoft Windows NTFS: Heap-based buffer overflow allows local privilege escalation

CVE-2026-96916High 7.8

← All vulnerabilities

Summary

A heap-based buffer overflow (CWE-122) in the Windows NTFS file system allows an authorized local attacker to elevate privileges. The attacker needs a valid low-privileged account on the system and no user interaction is required. The CVSS 3.1 base score is 7.8 (High), and the vulnerability cannot be exploited remotely.

Affected

  • Windows 10 Version 1607: 10.0.14393.0 to below 10.0.14393.9612
  • Windows 10 Version 1809: 10.0.17763.0 to below 10.0.17763.9376
  • Windows 10 Version 21H2: 10.0.19044.0 to below 10.0.19044.7807
  • Windows 10 Version 22H2: 10.0.19045.0 to below 10.0.19045.7807
  • Windows 11 Version 23H2: 10.0.22631.0 to below 10.0.22631.7652
  • Windows 11 Version 24H2: 10.0.26100.0 to below 10.0.26100.9711
  • Windows 11 Version 25H2: 10.0.26200.0 to below 10.0.26200.9711
  • Windows 11 Version 26H1: 10.0.28000.0 to below 10.0.28000.3231
  • Windows 11 Version 26H2: 10.0.26300.0 to below 10.0.26300.9711
  • Windows Server 2012 and 2012 R2 (including Server Core): see the MSRC page for build numbers
  • Windows Server 2016: 10.0.14393.0 to below 10.0.14393.9612

Note: third-party sources disagree on some Windows 11 and Server 2025 build numbers. Check the MSRC fix table.

Fixed in

Fixed in Microsoft's October 2026 security update. The fixed builds are listed in the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96916).

  • Windows 10 1809 / Server 2019: KB5126651 (cited by a third-party source)
  • Windows 10 1607: KB number unknown; take it from the MSRC page

Workaround

Unknown. No vendor workaround was found.

  • Limit local account privileges and remove unnecessary local administrator rights.

Exploitation

  • No evidence of in-the-wild exploitation was found.
  • CISA SSVC assessment: exploitation none, not automatable, total technical impact.
  • No public proof of concept was found.
  • EPSS: below 1 percent.
  • Zero Day Initiative describes related sandbox escapes via reparse points; this characterisation is narrower than the MSRC wording.

Our recommendation

  • Deploy Microsoft's October 2026 cumulative update on all affected systems, starting with multi-user file servers, Remote Desktop hosts and shared workstations.
  • Identify and upgrade any remaining Windows 10 1607 clients, as this edition is out of service.
  • Review local administrator group membership and remove unneeded accounts.
  • Monitor for suspicious privilege escalation on local accounts.

Information from Microsoft (Patch Tuesday October 2026)

Severity (Microsoft)
Important
Impact
Elevation of privilege – Windows NTFS
Status on Patch Tuesday
Neither exploited nor publicly disclosed
Exploitability assessment
Exploitation less likely
Product family
Windows, Windows ESU (Extended Security Updates)
Updates (KB)
KB5126657, KB5126655, KB5126653, KB5127648, KB5126646, KB5127646

Entry in the Microsoft Security Update Guide

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 00:45.

Original description (NVD)

Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed