This vulnerability (CVE-2026-50470) is an out-of-bounds read in the Windows Network Policy Server SNMP service on Windows 10 Version 1607 (build 10.0.14393.0). It enables an unauthenticated remote attacker to access information beyond intended memory boundaries, potentially disclosing sensitive data over the network. The CVSS v3.1 base score is 7.5, reflecting high severity due to network attack vector, low attack complexity, no privileges required, and high confidentiality impact. Microsoft has released an official fix for this vulnerability as documented in their security update guide.

An attacker can remotely exploit this vulnerability without authentication or user interaction to read memory outside the intended bounds in the Network Policy Server SNMP component. This leads to unauthorized disclosure of sensitive information, impacting confidentiality. There is no impact on integrity or availability. No known exploits are currently reported in the wild.

Microsoft has released an official fix for CVE-2026-50470. Users and administrators should apply the security update available from the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50470 to remediate this vulnerability.