pwned.coffeeOrder ticket · today's special · 27 Oct 2026

Double espresso · 355°CcriticalOrder up · fix available

Windows: memory corruption

Windows

Stack-based buffer overflow in Windows Internet Information Services allows an unauthorized attacker to execute code over a network.

Do this now

Install the Windows update fixing 10.0.14393.9612, 10.0.17763.9376 and 10.0.19044.7807, +10 more lines in Fix it.

Fix it

Windows 10 Version 1607

Upgrade to Windows 10 Version 1607 10.0.14393.9612

Windows 10 Version 1809

Upgrade to Windows 10 Version 1809 10.0.17763.9376

Windows 10 Version 21H2

Upgrade to Windows 10 Version 21H2 10.0.19044.7807

Windows 10 Version 22H2

Upgrade to Windows 10 Version 22H2 10.0.19045.7807

Windows 11 version 23H2

Upgrade to Windows 11 version 23H2 10.0.22631.7652

Windows 11 Version 24H2

Upgrade to Windows 11 Version 24H2 10.0.26100.9711

Windows 11 Version 25H2

Upgrade to Windows 11 Version 25H2 10.0.26200.9711

Windows 11 version 26H1

Upgrade to Windows 11 version 26H1 10.0.28000.3231

Windows 11 Version 26H2

Upgrade to Windows 11 Version 26H2 10.0.26300.9711

Windows Server 2012

Upgrade to Windows Server 2012 6.2.9200.26434

Windows Server 2012 (Server Core installation)

Upgrade to Windows Server 2012 (Server Core installation) 6.2.9200.26434

Windows Server 2012 R2

Upgrade to Windows Server 2012 R2 6.3.9600.23470

Windows Server 2012 R2 (Server Core installation)

Upgrade to Windows Server 2012 R2 (Server Core installation) 6.3.9600.23470

Windows Server 2016

Upgrade to Windows Server 2016 10.0.14393.9612

Windows Server 2016 (Server Core installation)

Upgrade to Windows Server 2016 (Server Core installation) 10.0.14393.9612

Windows Server 2019

Upgrade to Windows Server 2019 10.0.17763.9376

Windows Server 2019 (Server Core installation)

Upgrade to Windows Server 2019 (Server Core installation) 10.0.17763.9376

Windows Server 2022

Upgrade to Windows Server 2022 10.0.20348.5761

Windows Server 2025

Upgrade to Windows Server 2025 10.0.26100.33650

Windows Server 2025 (Server Core installation)

Upgrade to Windows Server 2025 (Server Core installation) 10.0.26100.33650

First seen: 27 Oct 2026
Last update: 27 Oct 2026, 09:18 UTC
Fixed in: Windows 10 Version 1607 10.0.14393.9612
Windows 10 Version 1809 10.0.17763.9376
Windows 10 Version 21H2 10.0.19044.7807
Windows 10 Version 22H2 10.0.19045.7807
Windows 11 version 23H2 10.0.22631.7652
Windows 11 Version 24H2 10.0.26100.9711
Windows 11 Version 25H2 10.0.26200.9711
Windows 11 version 26H1 10.0.28000.3231
Windows 11 Version 26H2 10.0.26300.9711
Windows Server 2012 6.2.9200.26434
Windows Server 2012 R2 6.3.9600.23470
Windows Server 2022 10.0.20348.5761
Windows Server 2025 10.0.26100.33650
Identifiers: CVE-2026-70024
CVSS: 9.8
Source: news
On the menu as: Windows

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Windows: memory corruption
Severity: critical. Patch status: patched.
Affected: Windows
Fixed in: Windows 10 Version 1607 10.0.14393.9612, Windows 10 Version 1809 10.0.17763.9376, Windows 10 Version 21H2 10.0.19044.7807, Windows 10 Version 22H2 10.0.19045.7807, Windows 11 version 23H2 10.0.22631.7652, Windows 11 Version 24H2 10.0.26100.9711, Windows 11 Version 25H2 10.0.26200.9711, Windows 11 version 26H1 10.0.28000.3231, Windows 11 Version 26H2 10.0.26300.9711, Windows Server 2012 6.2.9200.26434, Windows Server 2012 R2 6.3.9600.23470, Windows Server 2022 10.0.20348.5761, Windows Server 2025 10.0.26100.33650
Ids: CVE-2026-70024

Stack-based buffer overflow in Windows Internet Information Services allows an unauthorized attacker to execute code over a network.

## Steps
1. This touches infrastructure (windows). Look in terraform, ansible, cloud-init, Dockerfiles and docs for the product and version we run. If it isn't in the repo, say so and list what a human should check on the box.
2. Fix by release line: Windows 10 Version 1607: 10.0.x → 10.0.14393.9612. Windows 10 Version 1809: 10.0.x → 10.0.17763.9376. Windows 10 Version 21H2: 10.0.x → 10.0.19044.7807. Windows 10 Version 22H2: 10.0.x → 10.0.19045.7807. Windows 11 version 23H2: 10.0.x → 10.0.22631.7652. Windows 11 Version 24H2: 10.0.x → 10.0.26100.9711. Windows 11 Version 25H2: 10.0.x → 10.0.26200.9711. Windows 11 version 26H1: 10.0.x → 10.0.28000.3231. Windows 11 Version 26H2: 10.0.x → 10.0.26300.9711. Windows Server 2012: 6.2.x → 6.2.9200.26434. Windows Server 2012 (Server Core installation): 6.2.x → 6.2.9200.26434. Windows Server 2012 R2: 6.3.x → 6.3.9600.23470. Windows Server 2012 R2 (Server Core installation): 6.3.x → 6.3.9600.23470. Windows Server 2016: 10.0.x → 10.0.14393.9612. Windows Server 2016 (Server Core installation): 10.0.x → 10.0.14393.9612. Windows Server 2019: 10.0.x → 10.0.17763.9376. Windows Server 2019 (Server Core installation): 10.0.x → 10.0.17763.9376. Windows Server 2022: 10.0.x → 10.0.20348.5761. Windows Server 2025: 10.0.x → 10.0.26100.33650. Windows Server 2025 (Server Core installation): 10.0.x → 10.0.26100.33650.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Windows 10 Version 1607 10.0.x | fixed | 10.0.14393.9612 | — |
| Windows 10 Version 1809 10.0.x | fixed | 10.0.17763.9376 | — |
| Windows 10 Version 21H2 10.0.x | fixed | 10.0.19044.7807 | — |
| Windows 10 Version 22H2 10.0.x | fixed | 10.0.19045.7807 | — |
| Windows 11 version 23H2 10.0.x | fixed | 10.0.22631.7652 | — |
| Windows 11 Version 24H2 10.0.x | fixed | 10.0.26100.9711 | — |
| Windows 11 Version 25H2 10.0.x | fixed | 10.0.26200.9711 | — |
| Windows 11 version 26H1 10.0.x | fixed | 10.0.28000.3231 | — |
| Windows 11 Version 26H2 10.0.x | fixed | 10.0.26300.9711 | — |
| Windows Server 2012 6.2.x | fixed | 6.2.9200.26434 | — |
| Windows Server 2012 (Server Core installation) 6.2.x | fixed | 6.2.9200.26434 | — |
| Windows Server 2012 R2 6.3.x | fixed | 6.3.9600.23470 | — |
| Windows Server 2012 R2 (Server Core installation) 6.3.x | fixed | 6.3.9600.23470 | — |
| Windows Server 2016 10.0.x | fixed | 10.0.14393.9612 | — |
| Windows Server 2016 (Server Core installation) 10.0.x | fixed | 10.0.14393.9612 | — |
| Windows Server 2019 10.0.x | fixed | 10.0.17763.9376 | — |
| Windows Server 2019 (Server Core installation) 10.0.x | fixed | 10.0.17763.9376 | — |
| Windows Server 2022 10.0.x | fixed | 10.0.20348.5761 | — |
| Windows Server 2025 10.0.x | fixed | 10.0.26100.33650 | — |
| Windows Server 2025 (Server Core installation) 10.0.x | fixed | 10.0.26100.33650 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-70024") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70024 https://nvd.nist.gov/vuln/detail/CVE-2026-70024
https://pwned.coffee/i/stack-based-buffer-overflow-in-windows-internet-informat-cve-2026-70024

Timeline

27 Oct 2026, 09:18 UTC
Fix status: unknown → patched.
27 Oct 2026
First reported.

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
Windows 10 Version 1607 10.0.14393.0 to before 10.0.14393.9612 10.0.14393.9612 CVE record (CNA) checked 27 Oct
Windows 10 Version 1809 10.0.17763.0 to before 10.0.17763.9376 10.0.17763.9376 CVE record (CNA) checked 27 Oct
Windows 10 Version 21H2 10.0.19044.0 to before 10.0.19044.7807 10.0.19044.7807 CVE record (CNA) checked 27 Oct
Windows 10 Version 22H2 10.0.19045.0 to before 10.0.19045.7807 10.0.19045.7807 CVE record (CNA) checked 27 Oct
Windows 11 version 23H2 10.0.22631.0 to before 10.0.22631.7652 10.0.22631.7652 CVE record (CNA) checked 27 Oct
Windows 11 Version 24H2 10.0.26100.0 to before 10.0.26100.9711 10.0.26100.9711 CVE record (CNA) checked 27 Oct
Windows 11 Version 25H2 10.0.26200.0 to before 10.0.26200.9711 10.0.26200.9711 CVE record (CNA) checked 27 Oct
Windows 11 version 26H1 10.0.28000.0 to before 10.0.28000.3231 10.0.28000.3231 CVE record (CNA) checked 27 Oct
Windows 11 Version 26H2 10.0.26300.0 to before 10.0.26300.9711 10.0.26300.9711 CVE record (CNA) checked 27 Oct
Windows Server 2012 6.2.9200.0 to before 6.2.9200.26434 6.2.9200.26434 CVE record (CNA) checked 27 Oct
Windows Server 2012 (Server Core installation) 6.2.9200.0 to before 6.2.9200.26434 6.2.9200.26434 CVE record (CNA) checked 27 Oct
Windows Server 2012 R2 6.3.9600.0 to before 6.3.9600.23470 6.3.9600.23470 CVE record (CNA) checked 27 Oct
Score: CVSS 9.8 (critical). CVSS 3.1 9.8 (CNA microsoft) for CVE-2026-70024
Last checked: 27 Oct 2026, 10:17 UTC

Product	Affected	Fixed in	Source
Windows 10 Version 1607	10.0.14393.0 to before 10.0.14393.9612	10.0.14393.9612	CVE record (CNA) checked 27 Oct
Windows 10 Version 1809	10.0.17763.0 to before 10.0.17763.9376	10.0.17763.9376	CVE record (CNA) checked 27 Oct
Windows 10 Version 21H2	10.0.19044.0 to before 10.0.19044.7807	10.0.19044.7807	CVE record (CNA) checked 27 Oct
Windows 10 Version 22H2	10.0.19045.0 to before 10.0.19045.7807	10.0.19045.7807	CVE record (CNA) checked 27 Oct
Windows 11 version 23H2	10.0.22631.0 to before 10.0.22631.7652	10.0.22631.7652	CVE record (CNA) checked 27 Oct
Windows 11 Version 24H2	10.0.26100.0 to before 10.0.26100.9711	10.0.26100.9711	CVE record (CNA) checked 27 Oct
Windows 11 Version 25H2	10.0.26200.0 to before 10.0.26200.9711	10.0.26200.9711	CVE record (CNA) checked 27 Oct
Windows 11 version 26H1	10.0.28000.0 to before 10.0.28000.3231	10.0.28000.3231	CVE record (CNA) checked 27 Oct
Windows 11 Version 26H2	10.0.26300.0 to before 10.0.26300.9711	10.0.26300.9711	CVE record (CNA) checked 27 Oct
Windows Server 2012	6.2.9200.0 to before 6.2.9200.26434	6.2.9200.26434	CVE record (CNA) checked 27 Oct
Windows Server 2012 (Server Core installation)	6.2.9200.0 to before 6.2.9200.26434	6.2.9200.26434	CVE record (CNA) checked 27 Oct
Windows Server 2012 R2	6.3.9600.0 to before 6.3.9600.23470	6.3.9600.23470	CVE record (CNA) checked 27 Oct

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone very hot coffee