CVE-2026-69303: CWE-125: Out-of-bounds Read in Microsoft Windows 10 Version 1607

This vulnerability involves an out-of-bounds read in the Push Message Routing Service component of Microsoft Windows 10 Version 1607 and subsequent updates. An authorized attacker with local access can exploit this flaw to disclose sensitive information from memory. The issue is tracked as CWE-125 (Out-of-bounds Read). The vulnerability affects multiple Windows 10 builds starting from 10.0.14393.0 up to but excluding various patched builds (e.g., <10.0.14393.9512, <10.0.17763.9245, etc.). Microsoft has published an official security update to remediate this vulnerability.

An authorized local attacker can exploit this vulnerability to read memory outside the intended bounds, potentially disclosing sensitive information. There is no impact on integrity or availability. The vulnerability does not require user interaction and has a medium severity level.

Microsoft has released official security updates that fix this vulnerability. Users and administrators should apply the relevant patches for their Windows 10 versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69303. No additional mitigation steps are required once the patch is applied.