CVE-2026-69490: CWE-125: Out-of-bounds Read in Microsoft Windows 10 Version 1607

This vulnerability involves an out-of-bounds read condition in the Windows USB Mass Storage Class Driver. It affects various builds of Windows 10 starting from version 1607 and other specified builds up to certain update versions. Exploitation requires physical access and can result in privilege escalation. Microsoft has published an official fix for this issue as detailed in their security update guide.

Successful exploitation allows an attacker with physical access to the system to elevate their privileges, potentially gaining higher-level access than intended. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H). There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69490 to remediate this vulnerability.