CVE-2026-69314: CWE-416: Use After Free in Microsoft Windows 10 Version 1607

This vulnerability involves a use-after-free condition in the Windows Device Association Broker service, which can be exploited by an authorized attacker to elevate privileges remotely over a network. The issue affects multiple specific builds of Windows 10 Version 1607 and later, as enumerated by version ranges. The CVSS 3.1 base score is 7.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, but requiring low privileges and user interaction. Microsoft has published an official fix to address this vulnerability.

Successful exploitation allows an authorized attacker to elevate privileges on the affected Windows 10 systems remotely over a network. This can lead to full control over the system, compromising confidentiality, integrity, and availability of the affected device.

Microsoft has released official patches to remediate this vulnerability. Users and administrators should apply the provided security updates for their specific Windows 10 versions as listed in the affected versions to mitigate the risk. No additional mitigation steps are indicated by the vendor advisory.