CVE-2026-88143: CWE-122: Heap-based Buffer Overflow in Microsoft Windows 10 Version 1607

This vulnerability (CVE-2026-88143) involves a heap-based buffer overflow in the Windows Storage Spaces Controller component of Microsoft Windows 10 Version 1607 and later versions. The flaw permits a local attacker who already has high privileges to escalate their privileges further on the affected system. The vulnerability has been assigned a CVSS v3.1 base score of 6.7, indicating medium severity. Microsoft has issued an official fix for this vulnerability. No known exploits are reported in the wild at this time.

An authorized attacker with high privileges on the affected Windows 10 systems can exploit this heap-based buffer overflow to elevate their privileges, potentially gaining greater control over the system. The impact includes confidentiality, integrity, and availability impacts rated as high in the CVSS vector. However, exploitation requires local access with high privileges, limiting the attack surface.

An official fix is available from Microsoft for this vulnerability. Users and administrators should apply the security updates provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88143 to remediate this issue.