Windows Servicing Stack CVE-2026-83719

Primary fix: apply the vendor-released Microsoft servicing stack / cumulative security update for each affected build - Windows 11 23H2 at 10.0.22631.7652 or later, 24H2 at 10.0.26100.9711 or later, 25H2 at 10.0.26200.9711 or later, 26H1 at 10.0.28000.3231 or later, 26H2 at 10.0.26300.9711 or later; Windows Server 2019 / Windows 10 1809 at 10.0.17763.9376 or later; Windows 10 21H2/22H2 at 10.0.19044.7807 or later (verify the correct 22H2 build); Windows Server 2022 at 10.0.20348.5761 or later; and Windows Server 2025 at 10.0.26100.33650 or later. Patches are delivered through normal Windows Update / WSUS channels and are catalogued in the Microsoft Security Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83719; the advisory URL is the authoritative source for KB numbers per edition and should be checked before deployment in case build thresholds differ for specific SKUs. Because Servicing Stack Updates are a core component of the update pipeline, they cannot be disabled or uninstalled to remove the vulnerable code path, so there is no clean feature-level workaround - do not attempt to block Windows Update or servicing as a mitigation, as doing so both fails to address the over-read and defers other security fixes. The realistic compensating controls target the required prerequisite, namely a low-privileged authenticated local session: restrict interactive logon and RDP logon rights ("Allow log on locally" and "Allow log on through Remote Desktop Services") to the minimum necessary user set, and apply least privilege so that standard accounts cannot run arbitrary code on the host; the trade-off is reduced flexibility for shared or multi-user workstations and potential disruption of legitimate remote-support workflows. Additionally, tightly control who can reach the servicing code path by limiting local execution of tooling that manipulates CBS/servicing state to administrators, and treat any anomalous memory-disclosure-adjacent activity (for example, ASLR-bypass-oriented probing from non-administrative sessions) as a detection signal. These controls reduce exposure but do not eliminate the flaw - patching remains the only complete remedy. No vendor-released mitigation that removes the out-of-bounds read without installing the update was identified at time of analysis.