CVE-2026-72990: CWE-122: Heap-based Buffer Overflow in Microsoft Windows 10 Version 1607

This vulnerability (CVE-2026-72990) is a heap-based buffer overflow in the Windows Biometric Service component of Microsoft Windows 10 Version 1607 and subsequent updates. It allows an attacker with authorized local access to escalate privileges on the affected system. The flaw is identified as CWE-122 (Heap-based Buffer Overflow). The vulnerability affects multiple Windows 10 builds starting from 10.0.14393.0 up to but not including various patch versions such as 10.0.14393.9512, 10.0.17763.9245, and others. Microsoft has released an official security update to address this issue.

An authorized local attacker can exploit this heap-based buffer overflow to elevate their privileges on the affected Windows 10 system. This could lead to full system compromise depending on the privileges gained. The CVSS v3.1 base score is 7.8, indicating high severity with high impact on confidentiality, integrity, and availability.

Microsoft has released official security updates that fix this vulnerability. Users and administrators should apply the latest patches from Microsoft to affected Windows 10 versions as listed in the vendor advisory. No additional mitigation steps are required beyond applying the official fix.