This vulnerability (CVE-2026-40403) involves a heap-based buffer overflow in the Windows Win32K graphics subsystem (GRFX) on Windows 10 Version 1607 (build 10.0.14393.0). It permits an attacker who already has local access and limited privileges to execute arbitrary code, potentially leading to full system compromise. The vulnerability is classified under CWE-122 (Heap-based Buffer Overflow). Microsoft has published an official fix for this vulnerability, and no known exploits are reported in the wild at this time.

Successful exploitation of this vulnerability could allow an authorized local attacker to execute arbitrary code with elevated privileges, leading to complete compromise of the affected system. The impact includes full confidentiality, integrity, and availability loss as indicated by the CVSS vector (C:H/I:H/A:H).

An official fix is available from Microsoft. It is strongly recommended to apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40403 to remediate this vulnerability. No additional mitigations are specified beyond applying the official patch.