This vulnerability involves improper input validation in Microsoft Azure Attestation and Device Health Attestation services on Windows 10 Version 1607 (build 10.0.14393.0). It enables an authorized attacker with physical access to spoof attestation data, potentially compromising the integrity of attestation results. The CVSS 3.1 score is 3.9 (low), reflecting limited impact and the requirement for high privileges and physical access. Microsoft has issued an official fix and manages remediation for this cloud-hosted service. No public exploits are known.

The vulnerability allows an authorized attacker with physical access to spoof attestation data, impacting the integrity of the attestation process. There is no impact on confidentiality or availability. The low CVSS score reflects the limited scope and complexity of exploitation.

An official fix is available from Microsoft. Since this is a cloud service, Microsoft manages the remediation server-side. Users and administrators should ensure that their systems are updated according to Microsoft’s guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45642. No additional mitigation actions are required beyond applying the official fix.