This vulnerability (CWE-122) exists in the Windows FTP Service of Windows 10 Version 1607 (build 10.0.14393.0). It is a heap-based buffer overflow that can be exploited remotely by an attacker to execute arbitrary code, potentially leading to full system compromise. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Microsoft has released an official fix for this vulnerability as documented in their security update guide.

Successful exploitation allows remote code execution with high impact on confidentiality, integrity, and availability. An attacker can run arbitrary code on the affected system remotely without authentication or user interaction, potentially leading to full system compromise.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49172 to remediate this vulnerability.