This vulnerability involves a heap-based buffer overflow in the Volume Manager Extension Driver component of Windows 10 Version 1607 (build 10.0.14393.0). An attacker with authorized access and physical presence could exploit this flaw to execute arbitrary code on the affected system. The vulnerability is tracked as CVE-2026-40380 and is classified under CWE-122 (Heap-based Buffer Overflow). Microsoft has published an official fix to address this issue.

Successful exploitation could allow an authorized attacker with physical access to execute arbitrary code with elevated privileges, potentially compromising confidentiality, integrity, and availability of the affected system. The CVSS vector indicates low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40380 to remediate this vulnerability.