CVE-2026-69296: CWE-416: Use After Free in Microsoft Windows 10 Version 1607

This vulnerability, identified as CVE-2026-69296 and classified under CWE-416 (Use After Free), exists in the Windows Device Association Service. It allows an authorized attacker to perform privilege escalation remotely over a network. The vulnerability affects multiple specific builds of Windows 10, including versions starting from 10.0.14393.0 up to but not including 10.0.14393.9512, and similarly for other listed build ranges. The CVSS 3.1 vector indicates network attack vector, high complexity, low privileges required, user interaction needed, and impacts confidentiality, integrity, and availability with high severity. Microsoft has published an official fix for this vulnerability.

An authorized attacker can exploit this use-after-free vulnerability remotely over a network to elevate their privileges on the affected Windows 10 systems. This could lead to full system compromise, including complete control over the affected device's confidentiality, integrity, and availability.

An official fix is available from Microsoft. Administrators should apply the security updates provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69296 to remediate this vulnerability.