CVE-2026-83914 - Vulnerability Details

- Microsoft XML Remote Code Execution Vulnerability

Description

Use after free in Microsoft XML allows an unauthorized attacker to execute code over a network.

Published: 2026-10-13

Score: 8.1 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a use-after-free flaw in the Microsoft XML parser that allows an attacker who can supply a crafted XML document over the network to trigger arbitrary code execution. This can lead to full system compromise if the attacker achieves sufficient privileges. The weakness violates memory handling practices and is classified as CWE-416.

Affected Systems

Affected by the bug are Microsoft Windows 10 releases 1607, 1809, 21H2, and 22H2, all mainstream Windows 11 editions including 23H2, 24H2, 25H2, 26H2 and 26H1 variants, and Windows Server editions from 2012 up through 2025 in both full and Server‑Core installations.

Risk and Exploitability

The CVSS score of 8.1 labels the flaw as high severity, and while the EPSS score is not available, the vulnerability is exploitable over the network from an unauthorized attacker. It is not listed in CISA’s Known Exploited Vulnerabilities catalog. The likely attack vector is remote code execution via the network, inferred from the description and the nature of the flaw.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Microsoft

Windows 10 Version 1607

affected

Version	Status	Constraints
`10.0.14393.0`	affected	< 10.0.14393.9612

Microsoft

Windows 10 Version 1809

affected

Version	Status	Constraints
`10.0.17763.0`	affected	< 10.0.17763.9376

Microsoft

Windows 10 Version 21H2

affected

Version	Status	Constraints
`10.0.19044.0`	affected	< 10.0.19044.7807

Microsoft

Windows 10 Version 22H2

affected

Version	Status	Constraints
`10.0.19045.0`	affected	< 10.0.19045.7807

Microsoft

Windows 11 version 23H2

affected

Version	Status	Constraints
`10.0.22631.0`	affected	< 10.0.22631.7652

Microsoft

Windows 11 Version 23H2

affected

Version	Status	Constraints
`10.0.22631.0`	affected	< 10.0.22631.7652

Microsoft

Windows 11 Version 24H2

affected

Version	Status	Constraints
`10.0.26100.0`	affected	< 10.0.26100.9711

Microsoft

Windows 11 Version 25H2

affected

Version	Status	Constraints
`10.0.26200.0`	affected	< 10.0.26200.9711

Microsoft

Windows 11 version 26H1

affected

Version	Status	Constraints
`10.0.28000.0`	affected	< 10.0.28000.3231

Microsoft

Windows 11 Version 26H2

affected

Version	Status	Constraints
`10.0.26300.0`	affected	< 10.0.26300.9711

Microsoft

Windows Server 2012

affected

Version	Status	Constraints
`6.2.9200.0`	affected	< 6.2.9200.26434

Microsoft

Windows Server 2012 (Server Core installation)

affected

Version	Status	Constraints
`6.2.9200.0`	affected	< 6.2.9200.26434

Microsoft

Windows Server 2012 R2

affected

Version	Status	Constraints
`6.3.9600.0`	affected	< 6.3.9600.23470

Microsoft

Windows Server 2012 R2 (Server Core installation)

affected

Version	Status	Constraints
`6.3.9600.0`	affected	< 6.3.9600.23470

Microsoft

Windows Server 2016

affected

Version	Status	Constraints
`10.0.14393.0`	affected	< 10.0.14393.9612

Microsoft

Windows Server 2016 (Server Core installation)

affected

Version	Status	Constraints
`10.0.14393.0`	affected	< 10.0.14393.9612

Microsoft

Windows Server 2019

affected

Version	Status	Constraints
`10.0.17763.0`	affected	< 10.0.17763.9376

Microsoft

Windows Server 2019 (Server Core installation)

affected

Version	Status	Constraints
`10.0.17763.0`	affected	< 10.0.17763.9376

Microsoft

Windows Server 2022

affected

Version	Status	Constraints
`10.0.20348.0`	affected	< 10.0.20348.5761

Microsoft

Windows Server 2025

affected

Version	Status	Constraints
`10.0.26100.0`	affected	< 10.0.26100.33650

Microsoft

Windows Server 2025 (Server Core installation)

affected

Version	Status	Constraints
`10.0.26100.0`	affected	< 10.0.26100.33650

Configuration 1 [-]

OR	cpe:2.3:o:microsoft:windows_10_1607:::::::x64:*
	cpe:2.3:o:microsoft:windows_10_1607:::::::x86:*
	cpe:2.3:o:microsoft:windows_10_1809:::::::x64:*
	cpe:2.3:o:microsoft:windows_10_1809:::::::x86:*
	cpe:2.3:o:microsoft:windows_10_21h2:::::::arm64:*
	cpe:2.3:o:microsoft:windows_10_21h2:::::::x64:*
	cpe:2.3:o:microsoft:windows_10_21h2:::::::x86:*
	cpe:2.3:o:microsoft:windows_10_22h2:::::::arm64:*
	cpe:2.3:o:microsoft:windows_10_22h2:::::::x64:*
	cpe:2.3:o:microsoft:windows_10_22h2:::::::x86:*
	cpe:2.3:o:microsoft:windows_11_23h2:::::::arm64:*
	cpe:2.3:o:microsoft:windows_11_23h2:::::::x64:*
	cpe:2.3:o:microsoft:windows_11_24h2:::::::arm64:*
	cpe:2.3:o:microsoft:windows_11_24h2:::::::x64:*
	cpe:2.3:o:microsoft:windows_11_25h2:::::::arm64:*
	cpe:2.3:o:microsoft:windows_11_25h2:::::::x64:*
	cpe:2.3:o:microsoft:windows_11_26h1:::::::arm64:*
	cpe:2.3:o:microsoft:windows_11_26h1:::::::x64:*
	cpe:2.3:o:microsoft:windows_11_26h2:::::::arm64:*
	cpe:2.3:o:microsoft:windows_11_26h2:::::::x64:*
	cpe:2.3:o:microsoft:windows_server_2012:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2012:r2:::::::*
	cpe:2.3:o:microsoft:windows_server_2016::::::::
	cpe:2.3:o:microsoft:windows_server_2019::::::::
	cpe:2.3:o:microsoft:windows_server_2022:::::::x64:*
	cpe:2.3:o:microsoft:windows_server_2025:::::::x64:*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the Microsoft security update that addresses CVE-2026-83914 as published on the Microsoft Update Center.
If patching must be delayed, restrict or disable XML parsing services on affected machines or enforce strict group‑policy restrictions to limit processing of untrusted XML input.
Continue to monitor system logs for anomalous XML parsing activity or unexpected privilege escalation indicators.
Maintain network segmentation to limit exposure of vulnerable systems to potential attackers.

Generated by OpenCVE AI on October 14, 2026 at 06:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00801.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83914

History

Thu, 29 Oct 2026 18:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Microsoft windows 10 21h2 Microsoft windows 10 22h2 Microsoft windows 11 23h2 Microsoft windows 11 24h2 Microsoft windows 11 25h2 Microsoft windows 11 26h1 Microsoft windows 11 26h2
CPEs		cpe:2.3:o:microsoft:windows_10_1607:::::::x64:* cpe:2.3:o:microsoft:windows_10_1809:::::::x64:* cpe:2.3:o:microsoft:windows_10_21h2:::::::arm64:* cpe:2.3:o:microsoft:windows_10_21h2:::::::x64:* cpe:2.3:o:microsoft:windows_10_21h2:::::::x86:* cpe:2.3:o:microsoft:windows_10_22h2:::::::arm64:* cpe:2.3:o:microsoft:windows_10_22h2:::::::x64:* cpe:2.3:o:microsoft:windows_10_22h2:::::::x86:* cpe:2.3:o:microsoft:windows_11_23h2:::::::arm64:* cpe:2.3:o:microsoft:windows_11_23h2:::::::x64:* cpe:2.3:o:microsoft:windows_11_24h2:::::::arm64:* cpe:2.3:o:microsoft:windows_11_24h2:::::::x64:* cpe:2.3:o:microsoft:windows_11_25h2:::::::arm64:* cpe:2.3:o:microsoft:windows_11_25h2:::::::x64:* cpe:2.3:o:microsoft:windows_11_26h1:::::::arm64:* cpe:2.3:o:microsoft:windows_11_26h1:::::::x64:* cpe:2.3:o:microsoft:windows_11_26h2:::::::arm64:* cpe:2.3:o:microsoft:windows_11_26h2:::::::x64:* cpe:2.3:o:microsoft:windows_server_2012:-:::::::* cpe:2.3:o:microsoft:windows_server_2012:r2:::::::* cpe:2.3:o:microsoft:windows_server_2022:::::::x64:* cpe:2.3:o:microsoft:windows_server_2025:::::::x64:*
Vendors & Products		Microsoft windows 10 21h2 Microsoft windows 10 22h2 Microsoft windows 11 23h2 Microsoft windows 11 24h2 Microsoft windows 11 25h2 Microsoft windows 11 26h1 Microsoft windows 11 26h2

Tue, 13 Oct 2026 22:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 13 Oct 2026 19:15:00 +0000

Type	Values Removed	Values Added
Description		Use after free in Microsoft XML allows an unauthorized attacker to execute code over a network.
Title		Microsoft XML Remote Code Execution Vulnerability
First Time appeared		Microsoft Microsoft windows 10 1607 Microsoft windows 10 1809 Microsoft windows 10 21h2 Microsoft windows 10 22h2 Microsoft windows 11 23h2 Microsoft windows 11 24h2 Microsoft windows 11 25h2 Microsoft windows 11 26h1 Microsoft windows 11 Version 26h2 For Arm64-based Systems Microsoft windows Server 2012 Microsoft windows Server 2012 R2 Microsoft windows Server 2016 Microsoft windows Server 2019 Microsoft windows Server 2022 Microsoft windows Server 2025
Weaknesses		CWE-416
CPEs		cpe:2.3:a:microsoft:windows_11_version_26h2_for_arm64-based_systems:::::::: cpe:2.3:o:microsoft:windows_10_1607:::::::x86:* cpe:2.3:o:microsoft:windows_10_1809:::::::x86:* cpe:2.3:o:microsoft:windows_10_21H2:::::::x86:* cpe:2.3:o:microsoft:windows_10_22H2:::::::x64:* cpe:2.3:o:microsoft:windows_11_23H2:::::::arm64:* cpe:2.3:o:microsoft:windows_11_23H2:::::::x64:* cpe:2.3:o:microsoft:windows_11_24H2:::::::arm64:* cpe:2.3:o:microsoft:windows_11_25H2:::::::arm64:* cpe:2.3:o:microsoft:windows_11_26H1:::::::x64:* cpe:2.3:o:microsoft:windows_server_2012:::::::x64:* cpe:2.3:o:microsoft:windows_server_2012_R2:::::::x64:* cpe:2.3:o:microsoft:windows_server_2016:::::::: cpe:2.3:o:microsoft:windows_server_2019:::::::: cpe:2.3:o:microsoft:windows_server_2022:::::::: cpe:2.3:o:microsoft:windows_server_2025::::::::
Vendors & Products		Microsoft Microsoft windows 10 1607 Microsoft windows 10 1809 Microsoft windows 10 21h2 Microsoft windows 10 22h2 Microsoft windows 11 23h2 Microsoft windows 11 24h2 Microsoft windows 11 25h2 Microsoft windows 11 26h1 Microsoft windows 11 Version 26h2 For Arm64-based Systems Microsoft windows Server 2012 Microsoft windows Server 2012 R2 Microsoft windows Server 2016 Microsoft windows Server 2019 Microsoft windows Server 2022 Microsoft windows Server 2025
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83914
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}`

Subscriptions

Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 21h2 Windows 10 22h2 Windows 10 22h2 Windows 11 23h2 Windows 11 23h2 Windows 11 24h2 Windows 11 24h2 Windows 11 25h2 Windows 11 25h2 Windows 11 26h1 Windows 11 26h1 Windows 11 26h2 Windows 11 Version 26h2 For Arm64-based Systems Windows Server 2012 Windows Server 2012 R2 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2026-10-13T18:59:58.379Z

Updated: 2026-10-31T18:03:53.079Z

Reserved: 2026-08-31T23:28:54.596Z

Link: CVE-2026-83914

Vulnrichment

Updated: 2026-10-13T20:18:28.007Z

NVD

Status : Analyzed

Published: 2026-10-13T19:20:46.750

Modified: 2026-10-29T18:18:32.450

Link: CVE-2026-83914

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-10-14T06:45:17Z

Weaknesses

CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object