This vulnerability involves the use of an uninitialized resource in the Windows Boot Manager component of Windows 10 Version 1607 (build 10.0.14393.0). An attacker with physical access could exploit this flaw to bypass certain security features during the boot process. The CVSS 3.1 vector indicates the attack requires physical access (AV:P), has low attack complexity (AC:L), no privileges or user interaction needed (PR:N/UI:N), and impacts confidentiality (C:H) without affecting integrity or availability. Microsoft has published an official fix to remediate this vulnerability.

The vulnerability allows unauthorized physical attackers to bypass security features in the Windows Boot Manager, potentially exposing sensitive information (high confidentiality impact). There is no impact on system integrity or availability. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26175 to remediate this vulnerability. No additional mitigations are indicated by the vendor.