This vulnerability involves a buffer over-read in the Windows Win32K subsystem on Windows 10 Version 1607 (build 10.0.14393.0). An authorized attacker with local access and low privileges can exploit this flaw to disclose sensitive information from memory. The CVSS 3.1 vector indicates low attack complexity and privileges required, no user interaction, and a high confidentiality impact without affecting integrity or availability. Microsoft has published an official fix to address this issue.

The vulnerability allows local authorized attackers to read memory beyond the intended buffer boundaries, potentially exposing sensitive information. There is no impact on system integrity or availability. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62746 to remediate this vulnerability.