This vulnerability, identified as CWE-400, affects the HTTP/2 implementation in Microsoft Windows 10 Version 1607 (build 10.0.14393.0). It allows an unauthenticated attacker to trigger uncontrolled resource consumption, leading to denial of service conditions. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability. Microsoft has released an official fix to remediate this issue as documented in their security update guide.

Exploitation of this vulnerability results in denial of service by exhausting system resources via HTTP/2 traffic. There is no impact on confidentiality or integrity. The attack can be performed remotely without authentication or user interaction, potentially disrupting availability of affected systems.

An official fix is available from Microsoft. Users and administrators should apply the security update referenced in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49160 to remediate this vulnerability.