CVE-2026-96863: CWE-122: Heap-based Buffer Overflow in Microsoft Windows 11 version 23H2

This vulnerability, identified as CVE-2026-96863 and classified under CWE-122 (heap-based buffer overflow), exists in the Windows Storage Port Driver component of Windows 11 version 23H2. An attacker with physical access can exploit this flaw to elevate privileges on the system. The vulnerability affects multiple builds of Windows 11 23H2, specifically versions starting from 10.0.22631.0 up to but not including various patched builds (e.g., <10.0.22631.7652, <10.0.26100.9711, etc.). The CVSS 3.1 base score is 6.8, indicating medium severity, with attack vector requiring physical access, low attack complexity, no privileges required, and no user interaction. Microsoft has published an official fix for this vulnerability.

Successful exploitation allows an unauthorized attacker with physical access to the affected Windows 11 system to elevate privileges, potentially gaining higher-level access than intended. This could lead to full system compromise depending on the attacker's goals. The vulnerability impacts confidentiality, integrity, and availability with high impact ratings in the CVSS vector.

Microsoft has released an official fix for this vulnerability. Users and administrators should apply the provided security updates as soon as possible to remediate the issue. Since this is a physical attack vector, limiting physical access to systems also reduces risk. No additional mitigations are specified by the vendor advisory.