CVE-2026-70578: CWE-122: Heap-based Buffer Overflow in Microsoft Windows 10 Version 21H2

This vulnerability is a heap-based buffer overflow in the Windows Credential Guard component of Microsoft Windows 10 Version 21H2. It enables an authorized attacker with local access to elevate their privileges by exploiting the overflow condition. The CVSS 3.1 score is 7.0 (high), reflecting high impact on confidentiality, integrity, and availability, but requiring high attack complexity and local privileges. Multiple specific Windows 10 builds are affected, with fixed versions starting at 10.0.19044.7725, 10.0.19045.7725, 10.0.22631.7582, 10.0.26100.9445, 10.0.26200.9445, and 10.0.28000.2954 respectively. Microsoft has published an official fix for this vulnerability.

An authorized local attacker can exploit this heap-based buffer overflow to elevate privileges, potentially gaining higher system rights. The vulnerability impacts confidentiality, integrity, and availability of the affected system components. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70578 to remediate this vulnerability.