CVE-2026-68887: CWE-125: Out-of-bounds Read in Microsoft Windows 10 Version 1607

This vulnerability (CWE-125) is an out-of-bounds read in the Windows Message Queuing Queue Manager component of Microsoft Windows 10 Version 1607 and related builds. It enables an unauthenticated attacker to remotely trigger a denial of service condition. The CVSS 3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability. Multiple Windows 10 versions are affected, with patches released to address the issue. Microsoft has published an official fix and advisory for this vulnerability.

An attacker can exploit this vulnerability remotely without authentication or user interaction to cause a denial of service, impacting system availability. There is no confidentiality or integrity impact reported. No known exploits are currently in the wild.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68887. No additional mitigation steps are indicated by the vendor.