CVE-2026-72961: CWE-122: Heap-based Buffer Overflow in Microsoft Windows 10 Version 1607

This vulnerability (CVE-2026-72961) involves a heap-based buffer overflow caused by an out-of-bounds read in the Windows Hyper-V component. An attacker with authorized local access and high privileges can exploit this flaw to elevate privileges further on the affected Windows 10 versions. The issue impacts several Windows 10 builds starting from version 10.0.14393.0 up to but not including various patched builds (e.g., <10.0.14393.9512, <10.0.17763.9245, etc.). Microsoft has published an official security update to remediate this vulnerability.

Successful exploitation can lead to a complete compromise of confidentiality, integrity, and availability on affected systems due to privilege escalation. This allows an attacker to gain elevated privileges locally, potentially enabling further malicious actions. No known exploits are reported in the wild at this time.

Microsoft has released official security updates that address this vulnerability. It is recommended to apply these patches promptly to affected Windows 10 versions. Since an official fix is available, no additional mitigations are required beyond applying the vendor-provided updates.