CVE-2026-69738: CWE-190: Integer Overflow or Wraparound in Microsoft Windows 10 Version 1607

This vulnerability involves an integer overflow or wraparound in the Windows Biometric Service component of Microsoft Windows 10 Version 1607 and later versions. An authorized local attacker can exploit this flaw to elevate their privileges on the affected system. The issue is tracked as CWE-190 (Integer Overflow or Wraparound). Multiple affected Windows 10 builds are identified, all fixed in subsequent updates. Microsoft has published an official advisory and released patches to remediate the vulnerability.

Successful exploitation allows an authorized local attacker to elevate privileges, potentially gaining higher system rights than intended. This can lead to full system compromise or unauthorized access to sensitive resources. The CVSS v3.1 base score of 7.8 reflects high impact on confidentiality, integrity, and availability.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69738. No additional mitigation steps are required beyond applying the official patches.