CVE-2026-69589: CWE-122: Heap-based Buffer Overflow in Microsoft Windows 10 Version 1607

This vulnerability involves a heap-based buffer overflow in the Windows Biometric Service component of Microsoft Windows 10 Version 1607 and later versions. An authorized attacker with local access can exploit this flaw to elevate their privileges on the affected system. The vulnerability is tracked as CWE-122 and has a CVSS v3.1 base score of 7.8, indicating high severity. Multiple Windows 10 builds are affected, specifically versions from 10.0.14393.0 up to but not including 10.0.14393.9512, and similarly for other listed build ranges. Microsoft has issued an official patch to remediate this vulnerability.

Successful exploitation of this heap-based buffer overflow can allow an authorized local attacker to elevate privileges, potentially gaining higher-level access on the affected Windows 10 system. The vulnerability impacts confidentiality, integrity, and availability, as indicated by the CVSS vector (C:H/I:H/A:H). There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as soon as possible to remediate this vulnerability. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69589 for detailed update information and guidance.