EUVD-2026-99427
GHSA-9pvq-4h2c-4q2m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local session
-
DeliveryInvoke vulnerable Windows Storage code path
-
ExploitWin race / groom heap (AC:H)
-
ExecutionTrigger heap buffer overflow (CWE-122)
-
PersistExecute code as SYSTEM
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to already hold an authenticated low-privileged local account on the target Windows host (PR:L, AV:L - not remotely reachable). Exploitation is further limited by high attack complexity (AC:H): the heap-based buffer overflow in the Windows Storage component must be triggered under a specific condition (consistent with a race or precise heap state) rather than on demand, so reliable exploitation is non-trivial. No user interaction is needed (UI:N) and no special non-default configuration is called out in the description - the Windows Storage component is present by default. Realistic risk is highest on shared/multi-user systems (terminal servers, jump boxes) where low-privileged footholds are common. |
| Impact | This is a genuine but second-tier priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) describes a local privilege-escalation flaw that requires the attacker to already have an authenticated foothold (PR:L) and to win a high-complexity condition (AC:H), which for a heap overflow of this class typically means a timing/race or specific heap-grooming requirement rather than a deterministic trigger. The impact is total (C:H/I:H/A:H, SSVC Technical Impact: total), consistent with SYSTEM-level compromise once exploited. However, every exploitation signal points to low immediacy: CISA SSVC lists Exploitation: none and Automatable: no, there is no CISA KEV listing, and no public exploit or POC is referenced in the input - so there is no public exploit identified at time of analysis. No EPSS score was provided, so probabilistic exploitation likelihood cannot be factored in (MISSING). The signals are internally consistent rather than conflicting: a high-impact-but-hard-to-exploit local EoP that currently shows no exploitation. It should be patched as part of normal Patch Tuesday cadence and prioritized on multi-user or shared Windows hosts, but it is not a drop-everything network-facing emergency. |
| Exploit ScenarioDerived | An attacker who already has a low-privileged authenticated session on a Windows host (e.g., via phishing, a stolen credential, or a low-priv service account) runs a crafted program that drives the vulnerable Windows Storage component into a heap-based buffer overflow, winning the required race/complexity condition to corrupt heap memory and execute code at SYSTEM. No public exploit code is identified at time of analysis, and the high attack complexity means exploitation is not point-and-click. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Heap-based buffer overflow in the Windows Storage component allows an authenticated, low-privileged local user to elevate privileges to kernel-level code execution across a wide range of supported Windows 10, Windows 11, and Windows Server builds. Exploitation is constrained by high attack complexity - the overflow must be triggered under a specific, non-trivial condition (consistent with a race or a precisely groomed heap state) rather than on demand - and it requires the attacker to already hold a local account on the target host, making shared multi-user systems such as terminal servers, VDI hosts, and jump boxes the most realistic risk scenario. Microsoft has released fixes, and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records no exploitation and classifies the issue as not automatable, though technical impact is total once triggered (C:H/I:H/A:H).
RemediationAI
Patch status is positive: fixes are available from the vendor, so the primary action is to apply the current Microsoft cumulative update that brings each host to or above the fixed build for its branch - 10.0.14393.9612 (Windows 10 1607 / Server 2016), 10.0.17763.9376 (Windows 10 1809 / Server 2019), 10.0.19044.7807 (Windows 10 21H2 and 22H2), 10.0.22631.7652 (Windows 11 23H2), 10.0.26100.9711 (Windows 11 24H2), 10.0.26200.9711 (Windows 11 25H2), 10.0.28000.3231 (Windows 11 26H1), 10.0.26300.9711 (Windows 11 26H2), 10.0.20348.5761 (Server 2022), 10.0.26100.33650 (Server 2025), 6.2.9200.26434 (Server 2012), and 6.3.9600.23470 (Server 2012 R2) - using the Microsoft Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83911 as the authoritative source; note that any host still below its listed build, including the out-of-mainstream-support Server 2012/2012 R2 branches, remains vulnerable and those platforms may require an ESU entitlement or priority migration. Because the issue is a local privilege escalation with an AC:H trigger and no known exploit, patching can be prioritized after internet-facing issues, but should not be deferred indefinitely on multi-user hosts. Where immediate patching is not possible, the most effective compensating control is to reduce the number of low-privileged local interactive sessions that can reach the storage stack: restrict interactive logon and RDP access to shared hosts (terminal servers, jump boxes, VDI pools) to trusted administrators, remove standing local accounts and enforce just-in-time elevation - the trade-off is reduced operational flexibility for helpdesk and multi-tenant workloads. Enforcing least privilege and removing unnecessary local administrative tooling raises the cost of turning a corrupted heap into SYSTEM, though it does not eliminate the underlying overflow. Additional hardening with measurable trade-offs includes enabling Microsoft Defender and ASR rules plus WDAC/AppLocker to block unsigned code that would consume a corrupted heap (potential application-compatibility impact), and monitoring for unexpected storage-driver crashes, bugchecks (e.g., pool-corruption stop codes), or anomalous elevation events on hosts where low-privileged users are common. Disabling or removing the Windows Storage component is not a viable mitigation because it is part of the default kernel storage path and would break normal disk and volume operation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-122 heap-based buffer overflow in the Windows Storage component, the kernel-mode storage stack that handles device and volume I/O for Windows. A heap buffer is written past its allocated bounds, corrupting adjacent heap metadata or objects in kernel pool memory; because the storage stack runs with kernel privileges, successful corruption can be steered into controlled execution in ring 0 and a full SYSTEM-level compromise (integrity, confidentiality, and availability all rated High with scope unchanged). The CVSS vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H confirms the attack surface is strictly local (AV:L) and gated behind an existing low-privileged account (PR:L), with no user interaction beyond the attacker's own actions (UI:N). The high attack-complexity rating (AC:H) indicates the corruption is not reliably reachable on demand: the trigger depends on a specific heap layout or timing window, which is typical of pool-spray/grooming scenarios and means a would-be exploiter must first win a reliability problem before gaining elevation. The Windows Storage component is present by default, and the description calls out no non-default configuration prerequisite; EUVD tracks this as EUVD-2026-99427 with affected build ranges spanning Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025 including Server Core installations, from the legacy 6.2.9200/6.3.9600 branches up to the 10.0.26100/26200/26300 builds.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only EoP (AV:L) by an authenticated low-priv user (PR:L) winning a non-deterministic heap condition (AC:H), yielding SYSTEM-level total impact (C/I/A:H), no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A high-severity flaw in the Windows Storage component lets someone who already has an ordinary user account on a machine escalate to full control of the underlying operating system, and Microsoft has issued fixes across Windows 10, Windows 11, and Windows Server. The practical exposure is concentrated on shared, multi-user environments - terminal servers, VDI hosts, and jump boxes - where many users legitimately hold local accounts but should never reach kernel-level privileges. Because successful exploitation yields complete loss of confidentiality, integrity, and availability on the affected host, leadership should treat this as a containment and patching priority for those shared platforms rather than fleet-wide emergency work.
Apply vendor patch. Until it is deployed, reduce the attack surface by minimizing the number of local accounts on shared Windows 10, Windows 11, and Windows Server hosts (terminal servers, VDI, jump boxes), restricting interactive logon rights, isolating those systems from untrusted users, and monitoring for unusual privilege-escalation activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB