Microsoft Windows System Information Console: Heap Out-of-Bounds Write via a Case-Sensitivity Mismatch in .nfo Row Counting

Presentation

The System Information console (msinfo32.exe) is the inventory tool built into every Windows edition, and it owns the .nfo file association, so a saved report opens in it on a double click. A report passed on the command line or opened from Explorer is parsed during startup, before any window is shown and before the user can interact with the tool.

HDW Sec found a heap out-of-bounds write in that parser. CMSInfo7Category::WalkTree sizes the row array of a category from a case-sensitive count of its Data children, then walks the very same children with a case-insensitive comparison, so case-variant rows are written to the array without ever having been counted.

Microsoft rates the issue Important, scores it 9.8 (temporal 8.5) with a network attack vector and no user interaction, and records the impact as remote code execution.

Issue(s)

• CMSInfo7Category::WalkTree counts the rows of a category with a case-sensitive node selection on Data, and sizes the row array from that count alone, as four bytes per counted row.
• The loop that fills the array advances the row index on a case-insensitive comparison (_wcsicmp against Data), so an element written DATA, data or any other case variant is processed as a row although the sizing pass skipped it.
• The resulting write, a DWORD zeroed at rowArray[4 * rowIndex], therefore walks past the end of the allocation, four bytes further for every uncounted row, as far as the number of case-variant rows the file carries. A single category holding one exact-case Data element and a long run of DATA elements is enough.
• The sink is reached with no user interaction beyond opening the report: CMSInfoApp::Run calls CMSInfoDlg::OpenMSInfoFile, then CMSInfo7Category::ReadMSI7NFO, CMSInfo7Category::LoadFromXML and CMSInfo7Category::WalkTree.
• Confirmed live on msinfo32.exe 10.0.26100.8457 under Windows 11 build 26200, as a standard user at medium integrity and without page heap: a crafted report produced a deterministic access violation on write at WalkTree+0x618 (and dword ptr [rax+r13],0), bucketed by the debugger as INVALID_POINTER_WRITE, on three runs out of three, the faulting address landing page-aligned on the first unmapped page past the heap run.
• Microsoft classifies the flaw as CWE-122 (heap-based buffer overflow). HDW Sec tracks it as a heap out-of-bounds write (CWE-787) caused by two inconsistent string comparisons over one set of elements.
• Microsoft’s published description and FAQ present the vulnerability as an unauthenticated attacker sending a crafted packet to an affected service over the network, which is what the CVSS vector reflects with AV:N and UI:N. The reproduction HDW Sec reported is local: a crafted .nfo report parsed by the console as it loads.
• Microsoft assigns the exploitability index “Exploitation Less Likely” and reports the vulnerability as neither publicly disclosed nor exploited at publication.
• The console is part of the operating system, so the fix comes in the monthly cumulative update of each Windows version rather than as a separate package. Every supported branch is affected, from Windows Server 2012 to Windows 11 version 26H2.

References

• Microsoft Security Update Guide: CVE-2026-70157
• MITRE record: CVE-2026-70157
• Fix delivered in the Windows cumulative updates of 2026-10-13: KB5127648 for Windows 11 version 26H2, 25H2 and 24H2 (builds 10.0.26300.9711, 10.0.26200.9711 and 10.0.26100.9711), KB5127646 for Windows 11 version 26H1 (build 10.0.28000.3231), KB5126653 for Windows 11 version 23H2 (build 10.0.22631.7652), KB5126657 for Windows 10 version 22H2 and 21H2 (builds 10.0.19045.7807 and 10.0.19044.7807), KB5126651 for Windows 10 version 1809 and Windows Server 2019 (build 10.0.17763.9376), KB5126868 for Windows 10 version 1607 and Windows Server 2016 (build 10.0.14393.9612), KB5126646 for Windows Server 2025 (build 10.0.26100.33650), KB5126655 for Windows Server 2022 (build 10.0.20348.5761), KB5126836 for Windows Server 2012 R2 (build 6.3.9600.23470) and KB5126835 for Windows Server 2012 (build 6.2.9200.26434)