CVE-2026-69820: CWE-122: Heap-based Buffer Overflow in Microsoft Windows 10 Version 21H2

This vulnerability (CVE-2026-69820) involves a heap-based buffer overflow in the Windows Hello component of Microsoft Windows 10 Version 21H2. An attacker who is already authorized and has high privileges on the system can exploit this flaw to elevate their privileges further. The vulnerability affects multiple builds of Windows 10, specifically versions from 10.0.19044.0 up to but not including 10.0.19044.7725, 10.0.19045.0 up to but not including 10.0.19045.7725, 10.0.22631.0 up to but not including 10.0.22631.7582, 10.0.26100.0 up to but not including 10.0.26100.9445, 10.0.26200.0 up to but not including 10.0.26200.9445, and 10.0.28000.0 up to but not including 10.0.28000.2954. The vulnerability has been officially fixed by Microsoft.

An authorized attacker with high privileges can exploit this heap-based buffer overflow to elevate their privileges, potentially gaining full control over the affected system. The vulnerability impacts confidentiality, integrity, and availability with high severity. There are no known exploits in the wild at the time of publication.

Microsoft has released an official fix for this vulnerability. It is recommended to apply the security updates provided by Microsoft for the affected Windows 10 versions as soon as possible to mitigate the risk.