Windows Kernel: Heap-based buffer overflow enables local privilege escalation

Summary

A heap-based buffer overflow in the Windows Kernel allows an authorized local attacker to elevate privileges. The CVE record lists Windows 10, Windows 11, Windows Server 2012, 2012 R2 and 2016 as affected, and the CPE data also names Windows Server 2022. An attacker needs a local, low-privilege account, so the risk is mainly as a second step after another compromise, such as a stolen password. Successful exploitation would give full control of the affected system.

Affected

• Per the CVE record: Windows 10 Version 1607 (10.0.14393.0 to below 10.0.14393.9612), 1809 (below 10.0.17763.9376), 21H2 (below 10.0.19044.7807), 22H2 (below 10.0.19045.7807)
• Per the CVE record: Windows 11 23H2 (below 10.0.22631.7652), 24H2 and 25H2 (below 10.0.26100.9711 and 10.0.26200.9711), 26H1 (below 10.0.28000.3231), 26H2 (below 10.0.26300.9711)
• Per the CVE record: Windows Server 2012 and 2012 R2, including Server Core (below 6.2.9200.26434 and 6.3.9600.23470)
• Per the CVE record: Windows Server 2016 (below 10.0.14393.9612)
• Windows Server 2022: listed in the CVE CPE data, but not in the CNA affected list. Third-party data suggests builds below 10.0.20348.5761, which is unconfirmed. Unknown until checked on MSRC.

Fixed in

• Fixed builds as stated in the CVE record: see the 'below' build numbers above, which are the first fixed builds per branch.
• Windows Server 2022: the October 2026 cumulative update KB5126655 is reported at build 10.0.20348.5761. Unconfirmed. Install the latest cumulative update and confirm the fixed build on the MSRC page.

Workaround

• No vendor workaround found. Installing the security update is the remediation.
• Limit local and interactive logon to servers to required administrators and staff.
• Remove unused local accounts.
• Monitor servers for new privileged processes or services.

Exploitation

• CISA SSVC data: exploitation none, automatable no, technical impact total.
• No confirmed exploitation in the wild found. No public proof of concept found.
• A VulDB entry claims broker-market trade since 23 Sep 2026. This is an unverified estimate.
• SonicWall lists a detection signature for this CVE. A signature does not prove in-the-wild use.
• Status may have changed since the research date. Unknown.

Our recommendation

• Check all Windows Server hosts, including Server 2022, for the installed build and compare it with the fixed build on the MSRC page.
• Install the October 2026 security updates on the normal monthly cycle. Prioritise shared servers, Remote Desktop/Terminal servers and file servers with many users.
• Review local logon rights and shared administrator accounts on servers.
• Plan an upgrade path for Windows Server 2022, as mainstream support has ended and extended support runs until 14 Oct 2031.
• Re-check MSRC and CISA KEV for changes in exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-96929 msrc.microsoft.com
• OpenCVE: CVE-2026-96929 app.opencve.io
• Strix: CVE-2026-96929 www.strix.ai
• VulDB: vuln 419646 vuldb.com
• SonicWall: Microsoft security bulletin coverage for October 2026 www.sonicwall.com
• Microsoft: Windows Server release information learn.microsoft.com
• Merill MC1506288 mc.merill.net
• Wikipedia: Windows Server 2022 en.wikipedia.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 00:41.