CVE-2026-69384: CWE-476: NULL Pointer Dereference in Microsoft Windows 10 Version 1607

This vulnerability, identified as CWE-476 (NULL Pointer Dereference), exists in the Virtual Hard Disk (VHD) Miniport Driver component of Microsoft Windows 10 Version 1607. An attacker with local access can exploit this flaw to trigger a null pointer dereference, resulting in a denial of service by crashing the affected system component. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity, with attack vector local, low attack complexity, no privileges required, no user interaction, and scope changed. Microsoft has published an official fix addressing this issue.

The impact of this vulnerability is a denial of service condition caused by a null pointer dereference in the VHD Miniport Driver. This can disrupt system availability locally without compromising confidentiality or integrity. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 Version 1607 builds as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69384. No additional mitigation actions are specified by the vendor.