CVE-2026-68891: CWE-125: Out-of-bounds Read in Microsoft Windows 10 Version 1607

This vulnerability involves an out-of-bounds read in the Microsoft Standard XPS component on Windows 10 Version 1607 and other affected versions. An authorized attacker with low privileges can exploit this flaw locally to disclose sensitive information. The CVSS 3.1 vector indicates the attack requires local access, high attack complexity, low privileges, no user interaction, and impacts confidentiality but not integrity or availability. Microsoft has published an official fix addressing this issue.

The vulnerability allows local attackers with low privileges to read memory outside the intended bounds, potentially disclosing sensitive information. There is no impact on system integrity or availability. The attack complexity is high, reducing the likelihood of exploitation, and no known exploits are reported in the wild.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68891.