This vulnerability involves an out-of-bounds read condition in the Push Message Routing Service component of Microsoft Windows 10 Version 1607 (build 10.0.14393.0). An attacker with local authorized privileges can exploit this flaw to read memory beyond the intended buffer boundaries, potentially disclosing sensitive information. The issue does not allow for privilege escalation, denial of service, or remote exploitation without local access. Microsoft has released an official patch to address this vulnerability.

An authorized local attacker can exploit this vulnerability to read memory outside of the intended buffer, leading to potential information disclosure. There is no impact on integrity or availability, and no indication of remote exploitability. The confidentiality impact is rated high, but the overall severity is medium due to the requirement for local privileges.

An official fix is available from Microsoft. It is recommended to apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24282 to remediate this vulnerability.