This vulnerability (CVE-2026-40397) is classified as CWE-191 (Integer Underflow) and affects Windows 10 Version 1607 (build 10.0.14393.0). It involves a heap-based buffer overflow in the Windows Common Log File System Driver, which can be exploited by an authorized local attacker to gain elevated privileges. The CVSS v3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, low privileges required, no user interaction, and impacts confidentiality, integrity, and availability. Microsoft has published an official fix for this vulnerability.

An authorized local attacker can exploit this heap-based buffer overflow to elevate privileges on the affected Windows 10 Version 1607 system. This could allow the attacker to gain higher-level access than intended, potentially compromising system confidentiality, integrity, and availability.

Microsoft has released an official fix for this vulnerability. Users and administrators should apply the security update provided by Microsoft as soon as possible to remediate this issue. No additional mitigation steps are indicated by the vendor advisory.