Heap-based buffer overflow in Microsoft Windows and Windows Server - CVE-2026-116700
Published: November 11, 2026
Vulnerability identifier: #VU164976
CSH Severity: Low
CVSS v4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-116700
CWE-ID: CWE-122
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a user with physical access to system to elevate privileges and execute code with the privileges of the Network Service account.
The vulnerability exists due to a heap-based buffer overflow in Windows Telephony Service when handling data during a physical attack. A user with physical access to system can trigger heap memory corruption to execute code with the privileges of the Network Service account.
Affected software
Microsoft Windows
Windows Server
Windows Server
How to mitigate CVE-2026-116700
Install security update from vendor's website.
Microsoft Windows - addressed in versions 10 21H2 10.0.19044.7846, 10 22H2 10.0.19045.7846, 10 1607 10.0.14393.9688, 10 1809 10.0.17763.9487, 11 23H2 10.0.22631.7711
Windows Server - addressed in versions 2016 10.0.14393.9688, 2019 10.0.17763.9487, 2022 10.0.20348.5870
Windows Server - addressed in versions 2016 10.0.14393.9688, 2019 10.0.17763.9487, 2022 10.0.20348.5870