CVE-2026-40380 is a heap-based buffer overflow vulnerability in the Volume Manager Extension Driver component of Microsoft Windows 10 Version 1607 (build 10.0.14393.0). The flaw allows an attacker with authorized access and physical presence to execute arbitrary code on the affected system. The vulnerability is classified under CWE-122 (Heap-based Buffer Overflow). Microsoft has published an official fix to address this issue.

Successful exploitation of this vulnerability could allow an authorized attacker with physical access to the affected system to execute arbitrary code, potentially leading to full compromise of confidentiality, integrity, and availability of the system. The CVSS v3.1 base score is 6.2, reflecting medium severity with high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40380 to remediate this vulnerability.