This vulnerability, identified as CVE-2026-40397, is a heap-based buffer overflow in the Windows Common Log File System Driver of Windows 10 Version 1607 (build 10.0.14393.0). The root cause is an integer underflow (CWE-191) that leads to memory corruption. An authorized attacker with local access can exploit this flaw to elevate their privileges on the affected system. The CVSS v3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, and no user interaction required. Microsoft has published an official fix for this vulnerability.

Successful exploitation allows an authorized local attacker to elevate privileges, potentially gaining higher-level access to the system. The vulnerability affects confidentiality, integrity, and availability (all rated high impact). There are no known exploits in the wild at the time of publication.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft for Windows 10 Version 1607 to remediate this vulnerability. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40397 for detailed patching instructions.