CVE-2026-24288: Windows Mobile Broadband Driver Remote Code Execution Vulnerability

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-10 · updated 2026-06-19
Weakness: CWE-122

Description

Heap-based buffer overflow in Windows Mobile Broadband allows an unauthorized attacker to execute code with a physical attack.

Affected products

Microsoft Windows 10: before 10.0.19044.7058 — fixed in 10.0.19044.7058
Microsoft Windows 10: before 10.0.19045.7058 — fixed in 10.0.19045.7058
Microsoft Windows 10: from 10.0.19044.0 before 10.0.19044.7058 — fixed in 10.0.19044.7058
Microsoft Windows 10: from 10.0.19045.0 before 10.0.19045.7058 — fixed in 10.0.19045.7058

How to fix

Upgrade to a fixed version: Microsoft Windows 10 10.0.19044.7058; Microsoft Windows 10 10.0.19045.7058; Microsoft Windows 10 10.0.19044.7058; Microsoft Windows 10 10.0.19045.7058. Check the vendor advisory for mitigations.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24288

Get alerted when CVE-2026-24288 or the next vulnerability affects your stack