CVE-2026-71343: CWE-122: Heap-based Buffer Overflow in Microsoft Windows 10 Version 1607

This vulnerability, identified as CVE-2026-71343, involves a heap-based buffer overflow in the Windows Remote Access Connection Manager on Windows 10 Version 1607 and other specified builds. An authorized attacker with local access can exploit this flaw to execute arbitrary code, potentially leading to full system compromise. The issue affects multiple Windows 10 builds, including versions from 10.0.14393.0 up to but not including 10.0.14393.9512, and several other version ranges as detailed. The vulnerability has been assigned a CVSS v3.1 base score of 7.8, indicating high severity. Microsoft has issued official fixes for the affected versions, as documented in their security update guide.

Successful exploitation allows an authorized local attacker to execute arbitrary code on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability impacts Windows 10 Version 1607 and other specified builds, enabling code execution with elevated privileges.

Microsoft has released official patches for all affected versions to remediate this vulnerability. Users and administrators should apply these security updates promptly to mitigate the risk. Since the vulnerability requires local authorized access, ensuring systems are updated reduces the attack surface significantly.