CVE-2026-96916: CWE-122: Heap-based Buffer Overflow in Microsoft Windows 10 Version 1607

This vulnerability involves a heap-based buffer overflow in the Windows NTFS driver, which can be exploited by an authorized local attacker to gain elevated privileges on affected Windows 10 systems. The flaw affects multiple Windows 10 versions, including Version 1607 and later builds up to specific patched versions. The vulnerability is tracked as CWE-122 and has a CVSS v3.1 base score of 7.8, indicating high severity. Microsoft has released an official fix addressing this issue.

Successful exploitation of this vulnerability allows a local attacker with authorized access to escalate privileges, potentially gaining higher system rights. This can lead to full system compromise depending on the privileges obtained. The vulnerability impacts confidentiality, integrity, and availability (all rated high in CVSS).

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96916. No additional mitigation steps are required beyond applying the official patches.