CVE-2026-72957: CWE-122: Heap-based Buffer Overflow in Microsoft Windows 10 Version 1607

This vulnerability (CVE-2026-72957) involves a heap-based buffer overflow in Windows Deployment Services on affected Microsoft Windows versions. An authorized attacker with local privileges can exploit this flaw to execute arbitrary code locally. The CVSS v3.1 base score is 7.8, indicating high severity, with impact on confidentiality, integrity, and availability. The vulnerability affects several Windows 10 and Windows Server builds, specifically versions >=10.0.14393.0 <10.0.14393.9512, >=10.0.17763.0 <10.0.17763.9245, >=6.2.9200.0 <6.2.9200.26349, >=6.3.9600.0 <6.3.9600.23398, >=10.0.20348.0 <10.0.20348.5622, and >=10.0.26100.0 <10.0.26100.33438. Microsoft has released an official fix for this vulnerability.

Successful exploitation allows an authorized local attacker to execute arbitrary code on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the system. The vulnerability requires local privileges and no user interaction, and it affects Windows Deployment Services components.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72957. Applying the patch fully mitigates this vulnerability.