Microsoft Windows Search: Heap Out-of-Bounds Write in the In-Box HTML Filter via GB18030 Value Conversion

Presentation

nlhtml.dll is the HTML filter built into Windows. The Windows Search indexer loads it through query.dll to extract the text and properties of HTML documents, inside SearchFilterHost.exe, which runs as NT AUTHORITY\SYSTEM. An HTML file that reaches an indexed location is therefore parsed without anyone opening it.

HDW Sec found a heap out-of-bounds write in that filter. CXMLTag::GetValue converts a property value from UTF-16 to the code page of the document into a buffer sized for at most three bytes per character, an assumption that GB18030 breaks with its four-byte sequences.

Microsoft rates the issue Critical, scores it 9.8 (temporal 8.5) with a network attack vector and no user interaction, and records the impact as remote code execution.

Issue(s)

• CXMLTag::GetValue allocates the multibyte conversion buffer as three bytes per wide character of the value, terminator included, on the assumption that no character encodes to more than three bytes.
• GB18030 (code page 54936) encodes many BMP characters as four bytes, U+0080 to U+009A among them. A document that declares charset=gb18030 and carries a property value mixing such characters with ASCII fills the buffer exactly, and the terminating NUL is stored one byte past the end of the allocation.
• The reproduction is an HTML file holding an Office custom document property (o:CustomDocumentProperties). A 38-character value, 27 four-byte characters followed by 11 ASCII ones, gives a 120-byte allocation and a 120-byte conversion, so the NUL lands at offset 120. That length leaves the heap block without padding, so the stray byte reaches the header of the next block instead of being absorbed by slack.
• Under full page heap, Application Verifier reports a corrupted suffix pattern exactly one byte past the 0x78-byte block. Without page heap, the damaged header is detected at free time and the process dies with STATUS_HEAP_CORRUPTION (0xC0000374).
• No interaction is needed: copying the file into an indexed folder made two successive SearchFilterHost.exe instances, each with nlhtml.dll and the GB18030 code page module c_g18030.dll loaded, exit with 0xC0000374. A control file of the same shape whose value is plain ASCII was indexed without incident.
• Microsoft classifies the flaw as CWE-787 (out-of-bounds write). HDW Sec tracks it the same way, the root cause being an incorrect buffer size calculation (CWE-131).
• Microsoft’s FAQ describes an unauthenticated attacker sending an email with a crafted attachment that Microsoft Exchange Server indexes automatically through this component, which is what the CVSS vector reflects with AV:N and UI:N. The reproduction HDW Sec reported goes through the Windows Search indexer of a workstation, with the file placed in an indexed folder.
• Microsoft assigns the exploitability index “Exploitation Less Likely” and reports the vulnerability as neither publicly disclosed nor exploited at publication.
• The filter is part of the operating system, so the fix comes in the monthly cumulative update of each Windows version, and in the Hotpatch updates for the versions that receive them (nlhtml.dll is among the files patched by Hotpatch KB5132043). Every supported branch is affected, from Windows 10 version 1607 and Windows Server 2016 to Windows 11 version 26H2 and Windows Server 2025.

References

• Microsoft Security Update Guide: CVE-2026-116928
• MITRE record: CVE-2026-116928
• Fix delivered in the Windows cumulative updates of 2026-11-10: KB5132061 for Windows 11 version 26H2, 25H2 and 24H2 (builds 10.0.26300.9974, 10.0.26200.9974 and 10.0.26100.9974), or Hotpatch KB5132043 (builds 10.0.26300.9911, 10.0.26200.9911 and 10.0.26100.9911), KB5132059 for Windows 11 version 26H1 (build 10.0.28000.3501), KB5131087 for Windows 11 version 23H2 (build 10.0.22631.7711), KB5131096 for Windows 10 version 22H2 and 21H2 (builds 10.0.19045.7846 and 10.0.19044.7846), KB5131085 for Windows 10 version 1809 and Windows Server 2019 (build 10.0.17763.9487), KB5131291 for Windows 10 version 1607 and Windows Server 2016 (build 10.0.14393.9688), KB5131080 for Windows Server 2025 (build 10.0.26100.33822), or Hotpatch KB5131077 (build 10.0.26100.33730), and KB5131090 for Windows Server 2022 (build 10.0.20348.5870)