CVE-2026-68890: CWE-122: Heap-based Buffer Overflow in Microsoft Windows 10 Version 1607

This vulnerability, identified as CVE-2026-68890 and classified under CWE-122 (heap-based buffer overflow), affects Microsoft Standard XPS on Windows 10 Version 1607 and several other Windows 10 versions. It allows an authorized attacker with local access to exploit a heap-based buffer overflow to elevate privileges on the affected system. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. Microsoft has published an official fix for this vulnerability.

Successful exploitation of this vulnerability could allow an authorized local attacker to elevate their privileges, potentially gaining higher-level access to the affected system. The impact includes full compromise of confidentiality, integrity, and availability as indicated by the CVSS vector. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft as documented in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68890. No additional mitigation steps are indicated by the vendor advisory.