This vulnerability (CVE-2026-45642) arises from improper input validation in Microsoft Azure Attestation and Device Health Attestation services on Windows 10 Version 1607 (build 10.0.14393.0). It enables an authorized attacker with physical access to spoof the attestation process. The issue is classified under CWE-20 (Improper Input Validation). Microsoft has published an official fix and manages remediation for this cloud service. No known exploits are reported in the wild.

An authorized attacker with physical access can exploit this vulnerability to perform spoofing attacks against the attestation services, potentially undermining the integrity of device health and attestation processes. The confidentiality and availability are not impacted, but integrity is affected. The overall severity is low based on the CVSS score of 3.9.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users should apply the official updates as provided by Microsoft and refer to the vendor advisory for detailed patching instructions.