This vulnerability is a heap-based buffer overflow in the Windows Remote Desktop component of Windows 10 Version 1607 (build 10.0.14393.0). It enables a local attacker with authorized access to escalate privileges on the affected system. The flaw is tracked as CWE-122. Microsoft has published an official fix to address this issue.

Successful exploitation allows an authorized local attacker to elevate their privileges, potentially gaining higher-level access to the system. The vulnerability affects confidentiality, integrity, and availability with high impact as indicated by the CVSS vector (C:H/I:H/A:H). There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40398 to remediate this vulnerability.