CVE-2026-69298: CWE-190: Integer Overflow or Wraparound in Microsoft Windows 10 Version 1607

This vulnerability involves an integer overflow or wraparound in the Windows Biometric Service component of Microsoft Windows 10 Version 1607 and later versions. An authorized attacker with local access can exploit this flaw to elevate their privileges on the affected system. The issue is tracked as CWE-190. Multiple Windows 10 builds starting from 10.0.14393.0 up to but not including various patch versions are affected. Microsoft has published an official fix for this vulnerability.

Successful exploitation allows an authorized local attacker to elevate privileges, potentially gaining higher-level access than intended. The vulnerability affects confidentiality, integrity, and availability, as indicated by the CVSS vector (C:H/I:H/A:H). There are no known exploits in the wild at this time.

An official patch is available from Microsoft to remediate this vulnerability. Users and administrators should apply the updates provided in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69298 to mitigate the risk. No additional mitigation steps are specified by the vendor.