CVE-2026-69291: CWE-122: Heap-based Buffer Overflow in Microsoft Windows 10 Version 1607

This vulnerability, identified as CWE-122 (heap-based buffer overflow), exists in the Windows Volume Manager Extension Driver. It allows remote code execution by an unauthorized attacker over a network. Multiple Windows 10 versions are affected, specifically those versions starting from 10.0.14393.0 up to but not including 10.0.14393.9512 and other specified version ranges. The vulnerability has been assigned CVE-2026-69291 and has a CVSS v3.1 base score of 8.8, indicating high severity. Microsoft has published an official fix for this issue.

Successful exploitation of this vulnerability could allow an unauthorized attacker to execute arbitrary code remotely, potentially leading to full system compromise, including confidentiality, integrity, and availability impacts.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69291. No additional mitigation steps are required beyond applying the official patches.