EUVD-2026-99428
GHSA-v5h7-r869-8r86
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local session on Windows host
-
DeliveryInteract with vulnerable OpenSSH for Windows component
-
ExploitTrigger heap-based buffer overflow (CWE-122)
-
ExecutionCorrupt heap and hijack execution
-
ImpactElevate to full system privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must already have local access to a Windows system with the OpenSSH for Windows component installed/enabled and must hold a valid low-privileged account (PR:L) - this is not remotely or anonymously exploitable. Exploitation is further limited by High attack complexity (AC:H), consistent with heap-overflow bugs that require reliable heap layout control or a timing/race window; no user interaction is needed (UI:N). Affected systems are those below the patched builds listed by Microsoft (e.g. Windows 11 24H2/25H2/26H2 <10.0.26x00.9711, Server 2025 <10.0.26100.33650, Server 2019/Windows 10 1809 <10.0.17763.9376); patched builds are not exploitable. |
| Impact | This is a credible but second-tier priority - a genuine local privilege-escalation issue rather than a remotely wormable flaw. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 High) is internally consistent with the description's 'elevate privileges locally' wording: it requires local access, already-held low privileges, and high attack complexity, while delivering full C/I/A compromise on success. The AC:H is significant and typical of heap-based overflows (CWE-122), which usually demand reliable heap grooming or a race to achieve controlled corruption - this materially lowers real-world exploitability versus a straight AC:L bug. No EPSS score, KEV listing, or public POC was provided, so there is no signal of active or probable near-term exploitation; this reads as a defense-in-depth patch-on-cycle item, not an emergency. No signals conflict (local vector in CVSS matches the 'locally' claim in the description). The main residual risk is chaining: as a reliable local EoP it would be valuable as a post-compromise step after an attacker already has a foothold with a low-privileged account. |
| Exploit ScenarioDerived | An attacker who already has a low-privileged authenticated session on a Windows host running the OpenSSH component triggers a crafted condition that overflows a heap buffer in the OpenSSH code path, corrupting adjacent heap structures to redirect execution. Because attack complexity is High, success likely requires heap grooming or winning a race, so exploitation is not point-and-click. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
A heap-based buffer overflow in the OpenSSH for Windows component allows an authenticated local attacker with a low-privileged account to elevate privileges on the affected host, with high attack complexity required to reliably shape the heap for exploitation. Affected systems are Windows 10, Windows 11 and Windows Server 2019/2022/2025 installations whose OpenSSH component predates Microsoft's patched builds (for example, Windows 11 24H2/25H2 <10.0.26100.9711 and <10.0.26200.9711, Windows Server 2025 <10.0.26100.33650); updated builds are not exploitable. No public exploit code has been identified at time of analysis and Microsoft has released fixes, but the 7.0 CVSS score reflects full confidentiality, integrity and availability impact if the overflow is successfully turned into code execution; this is a genuine but second-tier local privilege-escalation issue rather than a remotely wormable flaw, and there is no confirmed active exploitation (no CISA KEV listing).
RemediationAI
Vendor-released patch: Microsoft has published fixes for this issue under CVE-2026-83871, so apply the update that raises each system to or above its fixed build (Windows 11 24H2 to 10.0.26100.9711, Windows 11 25H2 to 10.0.26200.9711, Windows 11 26H2 to 10.0.26300.9711, Windows 11 23H2 to 10.0.22631.7652, Windows 11 26H1 to 10.0.28000.3231, Windows 10 21H2/22H2 to 10.0.19044.7807, Windows 10 1809 and Windows Server 2019 to 10.0.17763.9376, Windows Server 2022 to 10.0.20348.5761, and Windows Server 2025 to 10.0.26100.33650) via Windows Update or the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83871. If immediate patching is not possible, compensating controls are limited and carry trade-offs: if the OpenSSH Server optional feature is not required, remove or disable it and stop/disable the sshd service, which eliminates the attack surface but removes remote SSH management; restrict SSH access to a narrow set of administrative accounts using AllowUsers/AllowGroups in sshd_config and remove or disable unnecessary low-privileged local accounts, since only an authenticated local low-privileged user (PR:L) can reach the vulnerable code path; and where inbound SSH from untrusted networks is unnecessary, block TCP 22 at the perimeter, understanding that this does not stop a local attacker. Because exploitation requires high attack complexity (AC:H), hardening local logon rights and monitoring the sshd service for unexpected crashes or child processes are useful detection-oriented supplements, but they do not substitute for applying the patched build.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 13 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenSSH for Windows (Win32-OpenSSH) is Microsoft's port of the OpenSSH client and server, distributed as an optional Windows feature and typically running sshd as a highly privileged service. The root cause here is CWE-122 (heap-based buffer overflow): a buffer allocated on the heap is written past its bounds while processing data, corrupting adjacent heap metadata or objects and potentially giving the attacker a controlled write primitive inside the privileged process. The CVSS vector AV:L/AC:H/PR:L/UI:N confirms the issue is only reachable by a local, low-privileged, authenticated user (PR:L) with high attack complexity (AC:H), consistent with an overflow that needs careful heap grooming or a narrow timing/layout window rather than a simple one-shot trigger; no user interaction is required from another party. The C:H/I:H/A:H impact triad means successful exploitation compromises data confidentiality, integrity and availability at the level of the compromised sshd process, which is why Microsoft rates the elevation-of-privilege potential as severe even though the entry barrier is local access.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only privilege escalation requiring an existing low-privileged account (PR:L) with heap-grooming effort (AC:H); successful corruption yields full code execution, so C/I/A all High.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.
Executive ViewAI
OpenSSH for Windows on unpatched Windows 10, Windows 11, and Windows Server 2019/2022/2025 systems contains a high-severity privilege-escalation flaw that could let a local low-privileged user gain elevated control of the host. Exploitation requires local access and significant complexity, and no public exploit identified at time of analysis and no CISA KEV listing, but the potential for full confidentiality, integrity, and availability impact makes timely patching a priority for any organization with OpenSSH deployed. Microsoft has released fixes, so leadership should direct teams to identify and update affected builds before an attacker with existing access can use this to deepen a compromise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB