Intel

CVE-2026-65797

microsoft windows_10_1607: Heap-basierter Pufferueberlauf

mediumEPSS 0.4%

Affected

  • microsoft/windows_10_1607 lt *..10.0.14393.9418
  • microsoft/windows_10_1607 lt *..10.0.14393.9418
  • microsoft/windows_10_1809 lt *..10.0.17763.9121
  • microsoft/windows_10_1809 lt *..10.0.17763.9121
  • microsoft/windows_10_21h2 lt *..10.0.19044.7663
  • microsoft/windows_10_21h2 lt *..10.0.19044.7663
  • microsoft/windows_10_21h2 lt *..10.0.19044.7663
  • microsoft/windows_10_22h2 lt *..10.0.19045.7663
  • microsoft/windows_10_22h2 lt *..10.0.19045.7663
  • microsoft/windows_10_22h2 lt *..10.0.19045.7663
  • microsoft/windows_11_23h2 lt *..10.0.22631.7517
  • microsoft/windows_11_23h2 lt *..10.0.22631.7517
  • microsoft/windows_11_24h2 lt *..10.0.26100.9106
  • microsoft/windows_11_24h2 lt *..10.0.26100.9106
  • microsoft/windows_11_25h2 lt *..10.0.26200.9106
  • microsoft/windows_11_25h2 lt *..10.0.26200.9106
  • microsoft/windows_11_26h1 lt *..10.0.28000.2704
  • microsoft/windows_11_26h1 lt *..10.0.28000.2704
  • microsoft/windows_server_2016 lt *..10.0.14393.9418
  • microsoft/windows_server_2019 lt *..10.0.17763.9121
  • microsoft/windows_server_2022 lt *..10.0.20348.5440
  • microsoft/windows_server_2025 lt *..10.0.26100.33222

Description

Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.

Source: BSI WID PortalBSI CSAFcvelistv5NVD (NIST)Microsoft Security Update Guide

Affected operating systems

  • windows

    microsoft / windows_10_1607

  • windows

    microsoft / windows_10_1809

  • windows

    microsoft / windows_10_21h2

  • windows

    microsoft / windows_10_22h2

  • windows

    microsoft / windows_11_23h2

  • windows

    microsoft / windows_11_24h2

  • windows

    microsoft / windows_11_25h2

  • windows

    microsoft / windows_11_26h1

  • windows

    microsoft / windows_server_2012r2

  • windows

    microsoft / windows_server_2012

  • windows

    microsoft / windows_server_2016

  • windows

    microsoft / windows_server_2019

  • windows

    microsoft / windows_server_2022

  • windows

    microsoft / windows_server_2025

Metrics

XIEM Effective CVSS
6.7
Source: nvd-v3
EPSS percentile
26.4 %
Elevated — this CVE ranks above at least 10% of all CVEs scored today.
KEV status
—
Show all metrics
Severity
medium
Priority score
64.08
Exploit maturity
no public PoC known
CVSS v3
6.7
EPSS score
0.4 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-08-11 17:06 UTC
CWE
CWE-197, CWE-122

Weakness classes (CWE)

  • CWE-197Base

    Numeric Truncation Error

    Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.

    cwe.mitre.org →

  • CWE-122Variant

    Heap-based Buffer Overflow

    A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

    cwe.mitre.org →

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. Initial Analysis2026-08-17 18:57 UTC· nvd@nist.gov
    • CPE Configuration: OR *cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* *cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* *cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.14393.9418 *cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:* versions up to (excluding) 10.0.14393.9418 *cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:* versions up to (excluding) 10.0.19044.7663 *cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.19044.7663 *cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:* versions up to (excluding) 10.0.19044.7663 *cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:* versions up to (excluding) 10.0.19045.7663 *cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.19045.7663 *cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:* versions up to (excluding) 10.0.19045.7663 *cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:* versions up to (excluding) 10.0.22631.7517 *cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.22631.7517 *cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:* versions up to (excluding) 10.0.26100.9106 *cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.26100.9106 *cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:* versions up to (excluding) 10.0.28000.2704 *cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.28000.2704 *cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:* versions up to (excluding) 10.0.26200.9106 *cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.26200.9106 *cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.14393.9418 *cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.20348.5440 *cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.26100.33222 *cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.17763.9121 *cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:* versions up to (excluding) 10.0.17763.9121 *cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.17763.9121
    • Reference Type: Microsoft Corporation: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65797 Types: Patch, Vendor Advisory
  2. CVE Modified2026-08-16 19:17 UTC· secure@microsoft.com
    • Affected: Windows 10 Version 1607, Windows 10 Version 1809, Windows 10 Version 21H2 (+17) → Windows 10 Version 1607, Windows 10 Version 1809, Windows 10 Version 21H2 (+17)
  3. CVE Modified2026-08-11 22:18 UTC· secure@microsoft.com
    • Affected: Windows 10 Version 1607, Windows 10 Version 1809, Windows 10 Version 21H2 (+17) → Windows 10 Version 1607, Windows 10 Version 1809, Windows 10 Version 21H2 (+17)
  4. New CVE Received2026-08-11 17:18 UTC· secure@microsoft.com
    • Affected: Windows 10 Version 1607, Windows 10 Version 1809, Windows 10 Version 21H2 (+17)
    • Description: Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.
    • CVSS V3.1: AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    • CWE: CWE-122

Linked advisories