This vulnerability involves a heap-based buffer overflow in the Connected Devices Platform Service (Cdpsvc) component of Microsoft Windows 10 Version 1809 (build 10.0.17763.0). An attacker with local authorized access can exploit this flaw to elevate their privileges on the affected system. The vulnerability is tracked as CWE-122 (Heap-based Buffer Overflow) and has a CVSS 3.1 base score of 7.8, indicating high impact on confidentiality, integrity, and availability. Microsoft has released an official fix for this issue as documented in their security update guide.

Successful exploitation allows an authorized local attacker to gain elevated privileges, potentially leading to full control over the affected system. The vulnerability impacts confidentiality, integrity, and availability of the system due to the nature of the buffer overflow.

An official fix is available from Microsoft and should be applied promptly to affected systems. Refer to the Microsoft security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20864 for the patch and detailed remediation instructions.