Microsoft NPS Heap Overflow Allows Remote Code Execution on Windows
A critical flaw in Windows Network Policy Server enables remote code execution via a heap-based buffer overflow in multiple supported versions.
Key points
- CVE-2026-100222 carries a CVSS score of 9.8, rated Critical by the NVD.
- The vulnerability affects Windows 10 versions 1607 through 22H2 and Windows 11 23H2.
- Attackers can exploit the heap-based buffer overflow to run code over a network.
Microsoft Windows Network Policy Server contains a critical remote code execution vulnerability that allows unauthorized attackers to run arbitrary code over a network. The flaw, tracked as CVE-2026-100222, stems from a heap-based buffer overflow within the NPS component, according to the National Vulnerability Database.
At a glance
- CVE
- CVE-2026-100222
- Product
- Microsoft Windows 10 Version 1607
- CVSS
- 9.8 Critical
- Weakness
- heap-based buffer overflow
- Exploited
- No known exploitation
The National Vulnerability Database assigns a CVSS score of 9.8 to this issue, classifying it as Critical. The underlying weaknesses are identified as CWE-122 (Heap-based Buffer Overflow) and CWE-191 (Integer Underflow). An attacker can exploit this flaw to execute code over a network on vulnerable systems, according to the NVD description.
Context and Background
This vulnerability impacts the Network Policy Server component in Windows. The NVD record explicitly states that the heap-based buffer overflow allows an unauthorized attacker to execute code over a network. The source material identifies the specific weaknesses as CWE-122 and CWE-191. No additional context about the typical usage of NPS is provided in the source material.
As Threat Times reported on 2026-10-13, Adobe Commerce and Magento Open Source were also hit by critical remote code execution flaws around the same period. While those issues affected web commerce platforms, this Microsoft vulnerability targets the Network Policy Server component in Windows.
Who Is Affected
Multiple versions of Microsoft Windows are affected by CVE-2026-100222. The NVD record lists specific build numbers that remain vulnerable if not updated. Affected systems include Windows 10 Version 1607 before build 10.0.14393.9612 and Windows 10 Version 1809 before build 10.0.17763.9376.
Windows 10 Version 21H2 and Version 22H2 are vulnerable if they run builds before 10.0.19044.7807. Additionally, Windows 11 Version 23H2 is affected if it is running a build before 10.0.22631.7652. Organizations must check their specific build numbers to determine exposure, as only versions meeting or exceeding these thresholds are considered patched.
What should you do?
Organizations should immediately inventory their Windows environments to identify any systems running the affected build numbers listed in the NVD record. Network Policy Server instances should be prioritized for review, as they are the specific component containing the heap-based buffer overflow. If a system is found to be running a vulnerable build, isolation from untrusted networks may be necessary until a patch is applied.
What to do and how to stay safe: Microsoft
- Verify the exact build number of all Windows 10 and 11 systems hosting Network Policy Server to check against the vulnerable versions listed in the NVD record.
- Restrict network access to NPS servers by ensuring they are not directly exposed to untrusted networks or the internet, reducing the attack surface for remote exploitation.
- Monitor system logs and network traffic for unusual activity or signs of unauthorized code execution attempts targeting the NPS service ports.
- Ensure that endpoint detection and response tools are configured to alert on suspicious process creation or memory manipulation indicative of buffer overflow exploitation.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-100222?
The National Vulnerability Database assigns a CVSS score of 9.8 to this vulnerability, rating it as Critical.
Which Windows versions are affected by this NPS vulnerability?
Windows 10 versions 1607, 1809, 21H2, and 22H2, as well as Windows 11 version 23H2, are affected if they run builds lower than those specified in the NVD record.
Does this vulnerability require user interaction to exploit?
The source material does not state whether user interaction is required; it only says an unauthorized attacker can execute code over a network.
