CVE-2026-69391: CWE-121: Stack-based Buffer Overflow in Microsoft Windows 10 Version 1607

This vulnerability (CVE-2026-69391) involves a stack-based buffer overflow in the Windows Broker Infrastructure Service component of Microsoft Windows 10 Version 1607 and later. An authorized local attacker can exploit this flaw to elevate privileges, potentially gaining higher system rights. The vulnerability affects multiple specific Windows 10 builds starting from version 10.0.14393.0 up to but not including various patched builds (e.g., <10.0.14393.9512, <10.0.17763.9245, etc.). The CVSS v3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, and no user interaction required. Microsoft has published an official fix for this vulnerability.

Successful exploitation allows an authorized local attacker to elevate their privileges on the affected Windows 10 system. This can lead to full control over the system, compromising confidentiality, integrity, and availability. The vulnerability does not require user interaction but does require local access and authorization.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69391. No additional mitigation steps are indicated beyond applying the official patches.