Windows PCI Bus Driver: Heap-based buffer overflow allows privilege escalation

Summary

A heap-based buffer overflow in the Windows PCI Bus Driver allows a locally authorized attacker to elevate privileges. Successful exploitation would give the attacker kernel-level control of the affected system, with high impact on confidentiality, integrity and availability. The attacker needs an existing local foothold, such as a standard user session or code running as a user.

Affected

• Windows 10 Version 1809 (LTSC): builds 10.0.17763.0 to below 10.0.17763.9376
• Windows 10 Version 21H2: builds 10.0.19044.0 to below 10.0.19044.7807
• Windows 10 Version 22H2: CNA record lists 10.0.19045.0 to below 10.0.19045.7807, which may be a data error and needs verification
• Windows 11 Version 23H2: builds 10.0.22631.0 to below 10.0.22631.7652
• Windows 11 Version 24H2: builds 10.0.26100.0 to below 10.0.26100.9711
• Windows 11 Version 25H2: builds 10.0.26200.0 to below 10.0.26200.9711
• Windows 11 Version 26H1: builds 10.0.28000.0 to below 10.0.28000.3231
• Windows 11 Version 26H2: builds 10.0.26300.0 to below 10.0.26300.9711
• Windows Server 2019 (including Server Core): builds 10.0.17763.0 to below 10.0.17763.9376
• Windows Server 2022: builds 10.0.20348.0 to below 10.0.20348.5761
• Windows Server 2025 (including Server Core): builds 10.0.26100.0 to below 10.0.26100.33650

Fixed in

• Windows 10 Version 1809 and Windows Server 2019: build 10.0.17763.9376 or later (derived from the CNA range, not yet confirmed against the Microsoft KB article)
• Other versions: see the fixed builds in the Microsoft advisory
• Patch details and KB numbers: Microsoft Security Update Guide

Workaround

Unknown. No vendor-documented workaround is known. Install the security update.

Exploitation

• Microsoft marks exploitation as Unproven and the vulnerability as not publicly disclosed.
• CISA SSVC (Vulnrichment): exploitation none, automatable no, technical impact total.
• Not listed in CISA KEV. EPSS is 0.00318.
• No public proof of concept found, but the search was not exhaustive.

Our recommendation

• Identify all Windows 10 1809, Windows 10 21H2/22H2, Windows 11, Windows Server 2019/2022/2025 hosts and check their build numbers.
• Install the Microsoft update from the advisory and verify the build afterwards. Prioritise multi-user systems, terminal servers, shared terminals and kiosks.
• Until patched, restrict local logon to trusted users, enforce least privilege and keep EDR active.
• Check whether Windows 10 1809 is still in use and plan its replacement or support path.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-96917 msrc.microsoft.com
• VulDB: CVE-2026-96917 vuldb.com
• Vulners CVE list: CVE-2026-96917 vulners.com
• Vulners Vulnrichment: CVE-2026-96917 vulners.com
• OpenCVE: CVE-2026-96917 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 17:53.