CVE-2026-83935
9.8CriticalPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-122
Impact
Remote, unauthenticated attackers can execute arbitrary code across the network with no user interaction required. They only need network reachability to an application processing untrusted input with the vulnerable library.
Root cause
A heap-based buffer overflow in Microsoft XML allows memory corruption during XML processing.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Install the official Microsoft security update for this CVE from Windows Update or WSUS once identified; block untrusted network traffic to vulnerable XML-parsing endpoints if immediate patching is not possible.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Heap-based buffer overflow in Microsoft XML allows an unauthorized attacker to execute code over a network.