Microsoft Windows System Info Console Has Critical Remote Code Execution Flaw
A heap-based buffer overflow in the Windows System Information Console allows unauthorized attackers to execute code over a network, rated critical severity.
Key points
- CVE-2026-70157 is a critical remote code execution vulnerability in Windows.
- The flaw involves a heap-based buffer overflow in the System Information Console.
- Attackers can exploit the issue over a network without prior authentication.
Microsoft has identified a critical remote code execution vulnerability within the Windows operating system. The flaw, tracked as CVE-2026-70157, resides in the Windows System Information Console component. According to the official advisory from the Microsoft Security Update Guide, this issue allows an unauthorized attacker to execute code over a network connection.
The National Vulnerability Database assigns a CVSS score of 9.8 to CVE-2026-70157, classifying the severity as critical. The underlying technical weakness is categorized under CWE-122, which denotes a heap-based buffer overflow. This specific type of memory corruption error occurs when data written to a heap buffer exceeds its allocated boundary, potentially allowing an attacker to overwrite adjacent memory structures and control program execution.
Context and Background
The Windows System Information Console is a built-in utility that provides detailed technical data about the hardware and software configuration of a Windows device. Because this component is part of the core operating system, it is present on virtually all Windows installations. The Microsoft Security Update Guide summary explicitly states that the vulnerability enables code execution over a network, implying that remote exploitation is possible without local physical access to the target machine.
According to the NVD record, the vulnerability description mirrors the Microsoft advisory, confirming that the heap-based buffer overflow is the primary vector for unauthorized code execution. The high severity rating of 9.8 indicates that the exploitability and impact are considered extremely high by industry standards.
Who Is Affected
The affected component is the Windows System Information Console, which is integrated into the Windows operating system. The source material does not specify particular Windows versions or editions that are exempt from this vulnerability. Consequently, it is reasonable to assume that systems running Windows with this console component are potentially at risk. The lack of version-specific exclusions in the provided advisory means that administrators should treat all Windows environments as potentially vulnerable until further clarification is provided by Microsoft.
The threat model described involves an unauthorized attacker acting over a network. This means that any system exposing the vulnerable service or interface to a network segment, including internal corporate networks or the public internet, could be targeted. The source material states that an unauthorized attacker can execute code over a network.
What should you do?
Microsoft has published an official advisory for CVE-2026-70157, but the provided source material does not confirm the availability of a patch, fix, or security update. Therefore, no immediate remediation via software update can be advised based on this information alone. Security professionals should monitor official Microsoft channels for the release of a security bulletin or update that addresses this specific CVE. Until a fix is confirmed, the focus should be on detection and network segmentation to limit exposure.
What to do and how to stay safe: Microsoft
- Monitor Microsoft Security Response Center advisories for the release of a patch for CVE-2026-70157.
- Review network logs for unusual traffic targeting the Windows System Information Console service.
- Restrict network access to systems running Windows to limit exposure to untrusted networks.
- Ensure endpoint detection and response tools are configured to alert on suspicious memory corruption behaviors.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-70157?
The National Vulnerability Database rates CVE-2026-70157 with a CVSS score of 9.8, which is considered critical severity.
Is there a patch available for this vulnerability?
The provided source material does not confirm that a patch or fix has been released for CVE-2026-70157.
What component is affected by this vulnerability?
The Windows System Information Console is the affected component, where a heap-based buffer overflow allows remote code execution.
