CVE-2026-58638: CWE-325: Missing Cryptographic Step in Microsoft Windows 10 Version 1809

This vulnerability, identified as CVE-2026-58638 and classified under CWE-325 (Missing Cryptographic Step), affects the Windows Boot Loader component in Microsoft Windows 10 Version 1809 (build 10.0.17763.0). The flaw involves a missing cryptographic step that enables an authorized local attacker with high privileges to bypass a security feature. The CVSS v3.1 base score is 6.0, indicating medium severity, with attack vector local, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity but no impact on availability. Microsoft has published an official fix for this vulnerability.

An authorized local attacker with high privileges can exploit this vulnerability to bypass a security feature in the Windows Boot Loader, potentially compromising system confidentiality and integrity. There is no impact on system availability. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft for Windows 10 Version 1809 (build 10.0.17763.0) as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58638.