Microsoft Windows 10 21H2/10 22H2 Mobile Broadband Driver heap-based overflow

Summaryinfo

A vulnerability marked as critical has been reported in Microsoft Windows 10 21H2/10 22H2. Affected is an unknown function of the component Mobile Broadband Driver. The manipulation leads to heap-based overflow. This vulnerability is uniquely identified as CVE-2026-24288. It is possible to launch the attack on the physical device. No exploit exists. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability was found in Microsoft Windows 10 21H2/10 22H2 and classified as critical. This issue affects an unknown code of the component Mobile Broadband Driver. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Heap-based buffer overflow in Windows Mobile Broadband allows an unauthorized attacker to execute code with a physical attack.

The weakness was disclosed 03/10/2026 as confirmed security update guide (Website). The advisory is shared at msrc.microsoft.com. The identification of this vulnerability is CVE-2026-24288. The exploitation is known to be easy. An attack has to be approached locally. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 07/07/2026).

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-0661). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Hitachi Storage
• Microsoft Windows
• Microsoft Windows Server 2012
• Microsoft Windows Server 2012 R2
• Microsoft Windows Server 2016
• Microsoft Windows 10
• Microsoft Windows Server 2019
• Microsoft Windows Server 2022
• Microsoft Windows 11
• Microsoft Windows Server 2025

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

Version

• 10 21H2
• 10 22H2

License

• commercial

Website

• Vendor: https://www.microsoft.com/
• Product: https://www.microsoft.com/en-us/windows

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion