This vulnerability (CVE-2026-42973) affects Windows 10 Version 1607 (build 10.0.14393.0) and involves the exposure of sensitive information to an unauthorized actor via Windows Push Notifications. The attacker requires local privileges and no user interaction is needed. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information). The CVSS 3.1 base score is 5.5 (medium severity), with attack vector local, low attack complexity, low privileges required, no user interaction, and high confidentiality impact. Microsoft has released an official fix for this vulnerability as documented in their security update guide.

An authorized attacker with local access can disclose sensitive information due to improper handling of Windows Push Notifications. The confidentiality of data is impacted, but integrity and availability are not affected. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft for Windows 10 Version 1607 to remediate this vulnerability. Refer to the Microsoft security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42973 for detailed patch information and installation instructions.