CVE-2026-96917: CWE-122: Heap-based Buffer Overflow in Microsoft Windows 10 Version 1809

This vulnerability (CVE-2026-96917) involves a heap-based buffer overflow in the Windows PCI Bus Driver component of Microsoft Windows 10. An authorized local attacker can exploit this flaw to elevate privileges on the affected system. The issue affects multiple specific Windows 10 versions, with patches provided by Microsoft to address the problem. The vulnerability is classified under CWE-122 (Heap-based Buffer Overflow) and has a CVSS v3.1 score of 8.8, indicating high severity. No known exploits in the wild have been reported at this time.

Successful exploitation allows an authorized local attacker to elevate privileges, potentially gaining full control over the affected system. The vulnerability impacts confidentiality, integrity, and availability, all rated high in the CVSS vector. There are no reports of active exploitation in the wild.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96917. No additional mitigation steps are indicated beyond applying the official patch.