This vulnerability (CVE-2026-42971) affects Windows 10 Version 1607 (build 10.0.14393.0) and is classified as CWE-200, indicating exposure of sensitive information to unauthorized actors. The flaw exists in the Windows Push Notifications component, allowing an attacker with limited privileges and local access to disclose sensitive information. The CVSS 3.1 base score is 5.5 (medium severity), with an attack vector requiring local access, low complexity, and low privileges. Microsoft has published an official fix for this vulnerability.

The vulnerability allows an authorized local attacker to gain access to sensitive information that should not be disclosed, potentially compromising confidentiality. There is no impact on integrity or availability. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft to remediate this vulnerability. Users and administrators should apply the security update provided by Microsoft for Windows 10 Version 1607 (build 10.0.14393.0) as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42971.