CVE-2026-73000: CWE-122: Heap-based Buffer Overflow in Microsoft Windows 10 Version 1607

This vulnerability involves a heap-based buffer overflow in the Windows Biometric Service component of Microsoft Windows 10 Version 1607 and later versions. An authorized local attacker can exploit this flaw to elevate privileges on the affected system. The vulnerability affects multiple Windows 10 builds starting from version 10.0.14393.0 up to but not including various patched builds (e.g., <10.0.14393.9512, <10.0.17763.9245, etc.). The CVSS 3.1 vector indicates the attack requires local access with low complexity and privileges, no user interaction, and results in high impact on confidentiality, integrity, and availability. Microsoft has released an official security update to remediate this vulnerability.

Successful exploitation allows an authorized local attacker to elevate privileges, potentially gaining higher system rights than intended. This can lead to full system compromise, affecting confidentiality, integrity, and availability of the system.

An official fix from Microsoft is available and should be applied promptly. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-73000 for the appropriate updates. Applying the official patch fully mitigates this vulnerability.