CVE-2026-69443: CWE-125: Out-of-bounds Read in Microsoft Windows 10 Version 1809

This vulnerability (CVE-2026-69443) involves an out-of-bounds read in the Microsoft Azure Attestation service and Device Health Attestation Service on Windows 10 Version 1809. The flaw permits an unauthorized attacker to remotely disclose sensitive information by reading memory outside the intended bounds. It affects Windows 10 builds from 10.0.17763.0 up to but not including 10.0.17763.9245, 10.0.20348.0 up to but not including 10.0.20348.5622, and 10.0.26100.0 up to but not including 10.0.26100.33438. The vulnerability has a CVSS v3.1 score of 7.5, indicating high severity, with network attack vector, low complexity, no privileges or user interaction required, and impact limited to confidentiality. Microsoft has released patches and manages remediation for this cloud-hosted service.

An unauthorized attacker can exploit this vulnerability remotely to disclose sensitive information from affected Windows 10 systems running the Azure Attestation and Device Health Attestation services. The impact is limited to confidentiality loss; integrity and availability are not affected. No privileges or user interaction are required for exploitation.

Microsoft has released official patches addressing this vulnerability. Users and administrators should apply the updates for Windows 10 Version 1809 as indicated in the Microsoft Security Response Center advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69443). Since this is a cloud-hosted service, Microsoft manages remediation server-side for the Azure Attestation service. Ensure that all relevant Windows 10 systems are updated to versions equal or higher than 10.0.17763.9245, 10.0.20348.5622, or 10.0.26100.33438 respectively.