This vulnerability (CVE-2026-42908) involves an out-of-bounds read in the Windows RDP component of Windows 10 Version 1607 (build 10.0.14393.0). It enables an attacker to remotely disclose sensitive information by sending specially crafted requests over the network. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact. Microsoft has released an official fix for this issue as documented in their security update guide.

Successful exploitation can lead to unauthorized disclosure of information over the network, potentially exposing sensitive data. There is no impact on integrity or availability. The vulnerability does not require privileges or user interaction, increasing its risk. No known exploits in the wild have been reported at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update for Windows 10 Version 1607 (build 10.0.14393.0) as provided in the Microsoft security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42908 to remediate this vulnerability.