CVE-2026-68874: CWE-125: Out-of-bounds Read in Microsoft Windows 10 Version 1607

This vulnerability involves an out-of-bounds read in the Windows Program Compatibility Assistant Service, which allows an authorized attacker to disclose information remotely over a network. The flaw affects various builds of Windows 10, including versions starting from 10.0.14393.0 up to but not including 10.0.14393.9512, and similarly for other specified build ranges. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges, user interaction, and high impact on confidentiality without affecting integrity or availability. Microsoft has published an official fix for this vulnerability.

Exploitation of this vulnerability can lead to unauthorized disclosure of information over a network by an attacker with authorized access. There is no impact on system integrity or availability. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68874. No additional mitigation steps are indicated by the vendor.