CVE-2026-69770: CWE-908: Use of Uninitialized Resource in Microsoft Windows 10 Version 1607

This vulnerability (CVE-2026-69770) involves the use of an uninitialized resource in the Windows kernel driver Spaceport.sys. It allows an authorized attacker with local access to disclose information due to improper initialization of resources. The issue affects various Windows 10 versions, including builds starting from 10.0.14393.0 up to but excluding patched builds such as 10.0.14393.9512 and others listed. The CVSS 3.1 base score is 5.5, indicating medium severity, with the attack vector being local and requiring low privileges. Microsoft has published an official fix for this vulnerability.

An authorized local attacker can exploit this vulnerability to disclose sensitive information on affected Windows 10 systems. The vulnerability does not allow privilege escalation, denial of service, or integrity impact, but the confidentiality impact is high. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft Security Response Center advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69770). No additional mitigation actions are specified by the vendor.