CVE-2026-96929: CWE-122: Heap-based Buffer Overflow in Microsoft Windows 10 Version 1607

This vulnerability is a heap-based buffer overflow in the Windows Kernel that permits an authorized local attacker to elevate privileges on affected Windows 10 versions. The flaw impacts several specific Windows 10 builds starting from version 10.0.14393.0 up to but not including various patch versions. The CVSS 3.1 vector indicates low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Microsoft has published an official fix for this vulnerability.

An authorized local attacker can exploit this heap-based buffer overflow to elevate privileges, potentially gaining higher system rights than intended. This could allow the attacker to execute code with elevated privileges, compromising system confidentiality, integrity, and availability.

Microsoft has released an official fix for this vulnerability. Users and administrators should apply the security updates provided by Microsoft to affected Windows 10 versions as soon as possible. No additional mitigation steps are indicated by the vendor advisory.