CVE-2026-69478: CWE-122: Heap-based Buffer Overflow in Microsoft Windows 10 Version 1607

This vulnerability, tracked as CVE-2026-69478, involves a heap-based buffer overflow in the Windows Device Association Service component of Microsoft Windows 10 Version 1607 and other specified builds. An attacker with authorized local access can exploit this flaw to elevate privileges on the affected system. The vulnerability is classified under CWE-122 (Heap-based Buffer Overflow). The CVSS v3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, and requiring low privileges. Microsoft has published an official fix for this issue.

Successful exploitation allows an authorized local attacker to elevate their privileges, potentially gaining higher-level access to the affected system. This can lead to full system compromise depending on the privileges obtained. The vulnerability affects confidentiality, integrity, and availability (all rated high impact).

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69478. No additional mitigation steps are indicated beyond applying the official patch.