CVE-2026-69672: CWE-908: Use of Uninitialized Resource in Microsoft Windows 10 Version 1607

This vulnerability, identified as CWE-908 (Use of Uninitialized Resource), affects multiple versions of Microsoft Windows including Windows 10 Version 1607 and other specified builds. It arises from the Windows DNS component using resources that have not been properly initialized, potentially leading to local information disclosure by an authorized attacker. The CVSS 3.1 base score is 5.5, indicating medium severity, with an attack vector of local access, low complexity, and requiring privileges. Microsoft has published an official fix for this issue.

An authorized attacker with local access and privileges can exploit this vulnerability to disclose sensitive information from the affected system. There is no impact on integrity or availability. The vulnerability does not require user interaction and is not known to be exploited in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69672. No additional mitigation actions are indicated by the vendor advisory.