This vulnerability involves a heap-based buffer overflow in the Volume Manager Extension Driver component of Windows 10 Version 1607 (build 10.0.14393.0). An attacker with authorized access and physical presence can exploit this flaw to execute arbitrary code, potentially leading to full compromise of the affected system. The CVSS vector indicates that the attack requires physical access (AV:P), low attack complexity (AC:L), and high privileges (PR:H), with no user interaction (UI:N). The impact includes high confidentiality, integrity, and availability impacts (C:H/I:H/A:H). Microsoft has published an official fix to remediate this vulnerability.

Successful exploitation allows an attacker with physical access and high privileges to execute arbitrary code on the affected system, compromising confidentiality, integrity, and availability. This could lead to full system compromise or unauthorized control over the system components managed by the Volume Manager Extension Driver.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40380 to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.