CVE-2026-70573: CWE-122: Heap-based Buffer Overflow in Microsoft Windows 10 Version 1607

This vulnerability, identified as CVE-2026-70573 and classified under CWE-122 (Heap-based Buffer Overflow), affects the Windows Biometric Service in Microsoft Windows 10 Version 1607 and subsequent updates. An authorized local attacker can exploit this flaw to gain elevated privileges on the affected system. The vulnerability has a CVSS v3.1 base score of 7.0, indicating high severity, with attack vector local, high attack complexity, low privileges required, and no user interaction needed. The impact includes high confidentiality, integrity, and availability impacts. Microsoft has released an official fix for this vulnerability.

An authorized local attacker can exploit this heap-based buffer overflow vulnerability to elevate privileges, potentially gaining higher system rights than intended. This could lead to full system compromise, including unauthorized access to sensitive data and disruption of system availability. There are no known exploits in the wild at this time.

Microsoft has released an official fix for this vulnerability. Users and administrators should apply the security updates provided by Microsoft for Windows 10 Version 1607 and affected subsequent versions as listed in the vendor advisory. No additional mitigation actions are required beyond applying the official patch.