Microsoft disclosed a heap-based buffer overflow in Windows Shell, tracked as CVE-2026-69829 and rated CVSS 9.8 Critical, that allows an unauthorized attacker to execute code over a network.
What Is It
CVE-2026-69829 is a heap-based buffer overflow in Windows Shell. Per Microsoft's description, the flaw allows an unauthorized attacker to execute code over a network. The CVSS 3.1 vector, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, scores it at 9.8 Critical: network-reachable, low attack complexity, no privileges required, no user interaction, with total loss of confidentiality, integrity, and availability.
Why It Matters
The combination of AV:N/AC:L/PR:N/UI:N is the worst-case profile for a memory corruption bug. There is no authentication step, no user click, and no elevated position required in the chain. Windows Shell is present on every affected build, from consumer Windows 10 endpoints through Server Core installations, so the exposed surface spans essentially the entire supported Windows fleet rather than an optional role or add-on component.
The record was published 2026-09-08 and remains in "Awaiting Analysis" status at NVD. As of publication, CVE-2026-69829 is not listed in CISA's Known Exploited Vulnerabilities catalog, so there is no confirmation of active exploitation at this time and no KEV-mandated remediation deadline.
What's Vulnerable
The table below summarizes the affected products and fixed builds as read from the MSRC update guide entry on 2026-09-08. It is a secondary transcription, not a verbatim reproduction of Microsoft's advisory, and MSRC revises these entries as servicing branches update; treat it as an orientation aid and confirm the current values in the MSRC entry itself before acting on any specific number.
| Product | Fixed build |
|---|---|
| Windows 10 1607 / Server 2016 (incl. Server Core) | 10.0.14393.9512 |
| Windows 10 1809 / Server 2019 (incl. Server Core) | 10.0.17763.9245 |
| Windows 10 21H2 | 10.0.19044.7725 |
| Windows 10 22H2 | 10.0.19045.7725 |
| Windows 11 23H2 (x64, ARM64) | 10.0.22631.7582 |
| Windows 11 24H2 | 10.0.26100.9445 |
| Windows 11 25H2 | 10.0.26200.9445 |
| Windows 11 26H1 | 10.0.28000.2954 |
| Windows Server 2012 (incl. Server Core) | 6.2.9200.26349 |
| Windows Server 2012 R2 (incl. Server Core) | 6.3.9600.23397 |
| Windows Server 2022 | 10.0.20348.5622 |
| Windows Server 2025 (incl. Server Core) | 10.0.26100.33438 |
One row pair deserves particular scrutiny: Windows 11 24H2 and Windows Server 2025 ship from the same 26100 build branch, but the transcribed revisions differ (26100.9445 versus 26100.33438). Same-branch SKUs normally converge on a single servicing revision, so the discrepancy may reflect a transcription or advisory-parsing artifact rather than Microsoft's actual guidance. Treat both 26100 rows as unresolved and confirm the correct revision for your SKU against the MSRC entry before using either number as a patch gate.
Affected platforms include 32-bit, x64-based, and ARM64-based systems depending on the product.
Patch Status
Microsoft's advisory indicates fixed builds for the listed products. Apply the Microsoft update that brings each system to at or above the build number confirmed in the MSRC entry for your SKU and servicing channel, and consult that entry for the specific KB packages tied to your channel rather than relying on the summary table above. Microsoft lists no workaround or mitigation for this vulnerability; patching is the only remediation.
Sources
- Microsoft MSRC Update Guide: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69829
- NVD, CVE-2026-69829, https://nvd.nist.gov/vuln/detail/CVE-2026-69829
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog