Microsoft Windows NTFS: Elevation of privilege via out-of-bounds read

Summary

A flaw in the Windows NTFS file system driver allows an authorized local attacker to elevate privileges, according to Microsoft's CNA record. An attacker needs a valid low-privileged local account and no user interaction is required. Successful exploitation would give the attacker full control (SYSTEM level) on the affected host. Microsoft rates exploitation as unlikely, and no in-the-wild use or public proof of concept is known.

Affected

• Windows 10 Version 1607 (CPE scope; Windows Server 2016 also listed)
• Windows 10 Version 1809, 21H2, 22H2
• Windows 11 Version 23H2, 24H2, 25H2, 26H1, 26H2
• Windows Server 2012, 2012 R2 (incl. Server Core)
• Windows Server 2016
• Exact build ranges: see MSRC Security Update Guide (CNA data also lists 10.0.14393.0 to < 10.0.14393.9612 for 1607)

Fixed in

• Windows 10 1607 / Server 2016: build 10.0.14393.9612 (KB5126868, 13 Oct 2026) or newer
• Windows 10 1809: build 10.0.17763.9376 or newer
• Windows 10 21H2 and 22H2: build 10.0.19044.7807 / 10.0.19045.7807 or newer
• Windows 11 23H2: build 10.0.22631.7652 or newer
• Windows 11 24H2, 25H2, 26H2: build 10.0.26100.9711 / 10.0.26200.9711 / 10.0.26300.9711 or newer
• Windows 11 26H1: build 10.0.28000.3231 or newer
• Windows Server 2012 / 2012 R2: build 6.2.9200.26434 / 6.3.9600.23470 or newer
• Windows 10 1607 requires ESU enrolment to receive the update

Workaround

Unknown. No official mitigation has been published; install the security update.

Exploitation

• Microsoft rates exploitation as "Exploitation Unlikely".
• CISA SSVC: exploitation none, not automatable, total technical impact.
• EPSS below 1%.
• No known in-the-wild exploitation or public proof of concept at the time of research.

Our recommendation

• Inventory Windows systems and identify Windows 10 1607 devices, and check their ESU enrolment.
• Install the October 2026 cumulative update on supported builds; test first on Exchange servers because of reported mail access issues.
• Plan migration of Windows 10 1607 devices, since they receive no free fix after end of support; use ESU only as a time-limited stopgap.
• Limit local logon on shared and fixed-function devices, and monitor for signs of privilege escalation.
• Confirm the affected build list in the MSRC guide.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-96928 msrc.microsoft.com
• Microsoft Learn: Windows 10 1607 and Windows Server 2016 release health learn.microsoft.com
• Microsoft Learn: Windows release information learn.microsoft.com
• Vulners CNA record CVE-2026-96928 vulners.com
• OpenCVE: CVE-2026-96928 app.opencve.io
• 4sysops: Windows 10 LTSB 2016 end of support and ESU 4sysops.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 00:40.