CVE-2026-57091 windows 10 1607 vulnerability
Stack-based buffer overflow in Windows File History Service allows an authorized attacker to elevate privileges locally.
Browse Windows security risksQuick answer
microsoft windows 10 1607 should be reviewed and updated if it matches the affected versions. The recommended fix is to apply the vendor-supported patched version or the mitigation steps below, then retest the public website with Fixnx.
Who is affected
Affected versions
- 10.0.14393.0 to before 10.0.14393.9339
Fixed versions
- 10.0.14393.9339
How to fix it
CVE-2026-57091 is a stack-based buffer overflow in Windows File History Service that can let a locally authenticated, low-privilege attacker elevate privileges; Microsoft rates exploitation as more likely. Install KB5099535, or a later superseding cumulative update, restart the system, and verify Microsoft Windows 10 Version 1607 is on OS build 10.0.14393.9339 or later. Prioritize shared and multi-user systems, remote-desktop hosts, and endpoints exposed to untrusted local accounts.
- Identify the asset owner, maintenance window, exposure, and business role for every affected Microsoft Windows 10 Version 1607 system.
- Inventory affected Windows endpoints and servers, then identify every Microsoft Windows 10 Version 1607 system below OS build 10.0.14393.9339.
- Install KB5099535, or a later superseding cumulative update, restart the system, and verify Microsoft Windows 10 Version 1607 is on OS build 10.0.14393.9339 or later.
- Microsoft lists no workaround. As defense in depth before patching, disable File History on systems that do not need it and restrict local logon and service-control rights.
- Review File History service crashes, local logons, privilege changes, process creation, and EDR alerts.
- If exploitation is suspected, isolate the system, preserve evidence, remove persistence, restore or rebuild from a known-good source, and rotate affected credentials.
- Confirm the required Windows restart completed, security tools are healthy, and temporary controls remain until the fleet is fully compliant.
Scan now. Google sign-in is only needed to unlock fix guidance.
Verify the fix
- Confirm Microsoft Windows 10 Version 1607 reports OS build 10.0.14393.9339 or later, KB5099535 or a superseding cumulative update is installed, and the last boot time is after installation.
- Confirm the patched component passes a safe vendor-approved regression or vulnerability scan without the previous finding.
- Confirm local-logon rights, untrusted-file handling, exposed Windows services and protocols, and host firewall rules match the system's approved security baseline.
- Review logs after remediation for continued exploit attempts or signs that the issue was used before the fix.
- Rerun the relevant dependency, platform, vendor, or Fixnx security check and document the result, affected assets, change record, and cleanup evidence for CVE-2026-57091.
Related categories
Related security risks
More published guidance from the same primary category.
Trusted references
FAQ
What is affected by CVE-2026-57091?
microsoft windows 10 1607 versions listed as affected should be reviewed: 10.0.14393.0 to before 10.0.14393.9339.
What should I fix first?
Start with internet-facing sites, admin panels, login flows, plugins, themes, modules, packages, and systems that process user-controlled input or sensitive data.
How do I confirm the fix worked?
Apply the patched version or mitigation, clear caches where relevant, retest the affected workflow, and run a new Fixnx scan to verify public website exposure signals.
How are Fixnx security risk categories chosen?
Fixnx keeps one canonical risk page and assigns only broad, relevant categories such as ecosystem, technology area, or vulnerability class.