Microsoft Windows: Remote code execution in OLE

Summary

An untrusted pointer dereference in the Windows Object Linking and Embedding (OLE) infrastructure allows an unauthorized attacker to execute arbitrary code over the network. No privileges or user interaction are required according to the CVSS vector, and the impact on confidentiality, integrity and availability is rated high. Multiple supported Windows 10, Windows 11 and Windows Server releases are listed as affected, although the NVD CPE lists only Windows 10 1607.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7807 (one source is inconsistent, verify on MSRC)
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9711
• Windows Server 2012 (incl. Server Core): 6.2.9200.0 to before 6.2.9200.26434
• Windows Server 2012 R2 (incl. Server Core): 6.3.9600.0 to before 6.3.9600.23470
• Windows Server 2016: 10.0.14393.0 to before 10.0.14393.9612

Fixed in

• Windows 10 1607 and Windows Server 2016: 10.0.14393.9612
• Windows 10 1809: 10.0.17763.9376
• Windows 10 21H2: 10.0.19044.7807
• Windows 10 22H2: 10.0.19045.7807
• Windows 11 23H2: 10.0.22631.7652
• Windows 11 24H2: 10.0.26100.9711
• Windows 11 25H2: 10.0.26200.9711
• Windows 11 26H1: 10.0.28000.3231
• Windows 11 26H2: 10.0.26300.9711
• Windows Server 2012 (incl. Server Core): 6.2.9200.26434
• Windows Server 2012 R2 (incl. Server Core): 6.3.9600.23470

Fix is part of the Microsoft security update released in the October 2026 Patch Tuesday cycle. Verify exact builds on the MSRC Security Update Guide.

Workaround

Unknown. A third-party aggregator recommends blocking or restricting network traffic to OLE components if patching is not possible immediately, but the exact guidance could not be confirmed on MSRC.

Exploitation

• Not listed in CISA KEV.
• CISA SSVC: exploitation none, automatable yes, technical impact total.
• EPSS is low (below 1% in one source, about 0.009 in another).
• No public proof-of-concept found in the search performed; this does not prove that none exists.

Our recommendation

• Inventory all Windows hosts and note their exact build numbers.
• Prioritise Windows 10 1607, Windows Server 2012/2016 and other OLE-exposed systems.
• Apply the Microsoft security update for CVE-2026-96924 to the fixed builds as soon as possible.
• If patching is delayed, restrict network access to affected services.
• Check whether 1607 or other long-term-servicing devices are still supported; verify on Microsoft's lifecycle page.
• Monitor for exploitation activity and new public exploit code.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-96924 msrc.microsoft.com
• OpenCVE: CVE-2026-96924 app.opencve.io
• Vulners CVE list entry: CVE-2026-96924 vulners.com
• Vulners VulnCheck enrichment: CVE-2026-96924 vulners.com
• VulDB: CVE-2026-96924 vuldb.com
• Strix: CVE-2026-96924 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:15.