This vulnerability involves a heap-based buffer overflow in the Windows Remote Desktop service on Windows 10 Version 1607. An attacker with local authorized access can exploit this flaw to gain elevated privileges, potentially leading to full system compromise. The vulnerability is tracked as CWE-122 and has been assigned CVE-2026-40398. Microsoft has released an official patch to remediate this issue.

Successful exploitation allows an authorized local attacker to elevate their privileges on the affected Windows 10 Version 1607 system. This could result in the attacker gaining higher-level access rights, compromising system integrity, confidentiality, and availability. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40398 to remediate this vulnerability. No additional mitigation steps are required beyond applying the official patch.