CVE-2026-68889: CWE-122: Heap-based Buffer Overflow in Microsoft Windows 10 Version 1607

This vulnerability (CVE-2026-68889) is a heap-based buffer overflow in the Microsoft Standard XPS component of Windows 10 Version 1607 and other related versions. An authorized attacker can exploit this flaw remotely over a network to elevate privileges. The CVSS 3.1 score is 7.1 (high severity) with attack vector network, high impact on confidentiality, integrity, and availability, and requiring low privileges with user interaction. Multiple Windows 10 builds are affected, with fixed versions starting at 10.0.14393.9512 and similar patch levels for other builds. Microsoft has released an official fix for this vulnerability.

Successful exploitation allows an authorized attacker to elevate privileges remotely over a network, potentially gaining higher system privileges. The vulnerability impacts confidentiality, integrity, and availability of the affected systems.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68889.