CVE-2026-69878: CWE-122: Heap-based Buffer Overflow in Microsoft Windows 10 Version 1607

This vulnerability (CVE-2026-69878) involves a heap-based buffer overflow in the Windows DHCP Server, which can be exploited by an authorized attacker with high privileges to execute arbitrary code locally. The affected versions include Windows 10 builds from 10.0.14393.0 up to but not including 10.0.14393.9512, 10.0.17763.0 up to 10.0.17763.9245, 6.2.9200.0 up to 6.2.9200.26349, 6.3.9600.0 up to 6.3.9600.23398, 10.0.20348.0 up to 10.0.20348.5622, and 10.0.26100.0 up to 10.0.26100.33438. The vulnerability is tracked under CWE-122 (Heap-based Buffer Overflow). Microsoft has published an official fix for this issue.

Successful exploitation allows an authorized attacker with high privileges to execute arbitrary code locally on the affected Windows 10 systems. This can lead to full compromise of the affected system's confidentiality, integrity, and availability. The CVSS score of 6.4 reflects a medium severity impact with high impact on confidentiality, integrity, and availability.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69878 to remediate this vulnerability.