CVE-2026-69350: CWE-122: Heap-based Buffer Overflow in Microsoft Windows 10 Version 1607

This vulnerability, tracked as CVE-2026-69350, involves a heap-based buffer overflow in the Windows Overlay Filter on Microsoft Windows 10 Version 1607 and several subsequent builds. An authorized attacker with local access can exploit this flaw to elevate their privileges. The vulnerability affects multiple specific Windows 10 versions starting from build 14393.0 up to but not including various later builds where patches have been applied. The CVSS 3.1 vector indicates the attack requires local access with low complexity, high privileges, no user interaction, and results in high impact on confidentiality, integrity, and availability. Microsoft has published an official fix for this vulnerability.

Successful exploitation of this heap-based buffer overflow can allow an authorized local attacker to elevate their privileges, potentially gaining higher-level access on the affected Windows 10 systems. This can lead to full system compromise depending on the privileges gained. The vulnerability impacts confidentiality, integrity, and availability of the system.

An official fix from Microsoft is available and should be applied promptly to affected systems. The vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69350 provides detailed update guidance. No additional mitigation steps are required beyond applying the official patch.