CVE-2026-83976VulnerabilityPublished 09/08/2026Updated 10/14/2026

CVE-2026-83976: CWE-122: Heap-based Buffer Overflow in Microsoft Windows 10 Version 1607

Affects Microsoft Windows 10 Version 1607Source CVE Database V5

CVSS 3.1 base score

7.8High

Exploitation: Not in CISA KEV, no exploitation reported
EPSS: 0.3% chance of exploitation in 30 days – higher than 25% of CVEs
Patch: Available

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

What to do

AI-suggested

Microsoft has released an official fix for this vulnerability. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions to remediate this issue. No additional mitigation steps are required beyond applying the official patch.

Affected software

Product	Affected	Fixed in
MicrosoftWindows 10 Version 1607	Affected >=10.0.14393.0 <10.0.14393.9512	Fixed in–
MicrosoftWindows 10 Version 1809	Affected >=10.0.17763.0 <10.0.17763.9245	Fixed in–
MicrosoftWindows 10 Version 21H2	Affected >=10.0.19044.0 <10.0.19044.7725	Fixed in–
MicrosoftWindows 10 Version 22H2	Affected >=10.0.19045.0 <10.0.19045.7725	Fixed in–
MicrosoftWindows 11 version 23H2	Affected >=10.0.22631.0 <10.0.22631.7582	Fixed in–
MicrosoftWindows 11 Version 23H2	Affected >=10.0.22631.0 <10.0.22631.7582	Fixed in–
MicrosoftWindows 11 Version 24H2	Affected >=10.0.26100.0 <10.0.26100.9445	Fixed in–
MicrosoftWindows 11 Version 25H2	Affected >=10.0.26200.0 <10.0.26200.9445	Fixed in–
MicrosoftWindows 11 version 26H1	Affected >=10.0.28000.0 <10.0.28000.2954	Fixed in–
MicrosoftWindows Server 2016	Affected >=10.0.14393.0 <10.0.14393.9512	Fixed in–
MicrosoftWindows Server 2016 (Server Core installation)	Affected >=10.0.14393.0 <10.0.14393.9512	Fixed in–
MicrosoftWindows Server 2019	Affected >=10.0.17763.0 <10.0.17763.9245	Fixed in–
MicrosoftWindows Server 2019 (Server Core installation)	Affected >=10.0.17763.0 <10.0.17763.9245	Fixed in–
MicrosoftWindows Server 2022	Affected >=10.0.20348.0 <10.0.20348.5622	Fixed in–
MicrosoftWindows Server 2025	Affected >=10.0.26100.0 <10.0.26100.33438	Fixed in–
MicrosoftWindows Server 2025 (Server Core installation)	Affected >=10.0.26100.0 <10.0.26100.33438	Fixed in–

Description

Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

Summary

This vulnerability involves a heap-based buffer overflow in the Windows Biometric Service component of Microsoft Windows 10 Version 1607 and later versions. An authorized local attacker can exploit this flaw to elevate privileges on the affected system. The flaw is identified as CWE-122. Multiple specific Windows 10 build ranges are affected, and Microsoft has released an official fix to address the issue.

Impact

Successful exploitation allows an authorized local attacker to elevate privileges, potentially gaining higher-level access on the affected Windows 10 system. This can lead to full system compromise depending on the privileges gained. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector.

Weaknesses

CWE-122Heap-based Buffer Overflow (opens in a new tab)

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83976 (opens in a new tab)

What to do

Affected software

Description

AnalysisAI-generated, updated 10/14/2026, 22:12:35 UTC

Technical details

Weaknesses

References

Related threats