CVE-2026-81354: CWE-122: Heap-based Buffer Overflow in Microsoft Windows 10 Version 1809

This vulnerability (CVE-2026-81354) is a heap-based buffer overflow in the Windows Hello component of Microsoft Windows 10 Version 1809 and subsequent builds. It enables a local attacker with existing privileges to escalate their privileges further. The flaw is tracked under CWE-122 and has a CVSS v3.1 base score of 8.2, indicating high severity. The affected versions include multiple Windows 10 builds starting from 10.0.17763.0 up to but not including specific patched builds (e.g., <10.0.17763.9245). Microsoft has published an official fix for this vulnerability.

An authorized local attacker can exploit this heap-based buffer overflow to elevate their privileges on the affected Windows 10 systems. This could lead to full system compromise, including complete control over confidentiality, integrity, and availability of the system. No known exploits in the wild have been reported at this time.

Microsoft has released an official fix for this vulnerability. Users and administrators should apply the latest security updates from Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81354 to remediate this issue.