This vulnerability involves the use of an uninitialized resource in the Windows Boot Manager component of Windows 10 Version 1607 (build 10.0.14393.0). The flaw enables an attacker with physical access to bypass a security feature, potentially compromising system security. The CVSS 3.1 vector indicates the attack requires physical access (AV:P), has low attack complexity (AC:L), requires no privileges (PR:N), no user interaction (UI:N), and impacts confidentiality (C:H) without affecting integrity or availability. Microsoft has published an official fix to remediate this vulnerability.

An attacker with physical access to a vulnerable system can bypass a security feature in the Windows Boot Manager, potentially leading to unauthorized access to sensitive information. The impact is limited to confidentiality compromise without affecting system integrity or availability. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. It is recommended to apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26175 to remediate this vulnerability.