CVE-2026-72967: CWE-122: Heap-based Buffer Overflow in Microsoft Windows 10 Version 1607

This vulnerability (CVE-2026-72967) involves a heap-based buffer overflow in the Windows Network Connection Broker service in multiple versions of Microsoft Windows 10, including Version 1607 and several subsequent builds. An attacker with authorized local access can exploit this flaw to elevate their privileges, potentially gaining higher-level system permissions. The CVSS v3.1 base score is 7.8, indicating high severity, with impacts on confidentiality, integrity, and availability. Microsoft has published an official security update to remediate this vulnerability.

Successful exploitation allows an authorized local attacker to elevate privileges, potentially gaining administrative control or equivalent high-level permissions on the affected Windows 10 systems. This could lead to full system compromise, including unauthorized access to sensitive data and disruption of system operations.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72967 to remediate this vulnerability. No additional mitigation steps are required beyond applying the official patch.