CVE-2026-69832: CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere in Microsoft Windows 10 Version 1607

This vulnerability, identified as CVE-2026-69832 and classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), affects multiple builds of Microsoft Windows 10 including Version 1607 and later updates. It allows an authorized local attacker with low privileges to disclose sensitive system information through the Windows Win32K subsystem. The vulnerability has a CVSS 3.1 base score of 5.6, indicating medium severity, with attack vector local, high attack complexity, and low privileges required. The impact is limited to confidentiality loss without integrity or availability impact. Microsoft has published an official fix for this vulnerability.

An authorized local attacker can disclose sensitive system information, potentially leading to confidentiality breaches. There is no impact on system integrity or availability. The vulnerability requires local access and high attack complexity, limiting the ease of exploitation. No known exploits are reported in the wild.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69832. No additional mitigation actions are required beyond applying the official patch.