Executive brief
Microsoft Account is a core authentication service used across Microsoft products and Windows systems. A heap buffer overflow vulnerability allows an authorized attacker to elevate their privileges on the local system, potentially gaining administrator-level access and full control of the affected computer.
Technical details
A heap-based buffer overflow exists in Microsoft Account, reachable by an authenticated local attacker. The vulnerability occurs in memory management and can be triggered by a malformed input or operation. Successful exploitation allows privilege escalation from a standard user context to a higher privilege level (likely SYSTEM or administrator). An attacker must already have local access and valid credentials to exploit this vulnerability. A patch is available via Microsoft Security Updates.
Affected products
- Microsoft Account
Timeline
- 2026-09-08: disclosed