CVE-2026-69393: CWE-125: Out-of-bounds Read in Microsoft Windows 10 Version 1607

This vulnerability (CVE-2026-69393) involves an out-of-bounds read in the Windows Spaceport.sys driver. An authorized attacker can exploit this flaw to disclose sensitive information remotely over a network. The issue affects various Windows 10 builds starting from version 1607 and later cumulative updates up to specific build numbers before patches were applied. The vulnerability has been assigned a CVSS 3.1 base score of 5.7, indicating medium severity. Microsoft has published an official fix, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability allows an authorized attacker to read memory outside the intended bounds, potentially disclosing sensitive information over a network. There is no impact on integrity or availability reported. The attacker requires some level of privileges (PR:L) and user interaction (UI:R) to exploit this vulnerability.

An official fix is available from Microsoft for all affected Windows 10 versions. Administrators should apply the latest security updates as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69393. No additional mitigations are required beyond applying the official patches.