CVE-2026-69844: CWE-125: Out-of-bounds Read in Microsoft Windows 10 Version 1607

This vulnerability (CVE-2026-69844) is an out-of-bounds read flaw in the Windows Win32K subsystem. It allows an authorized attacker with local access to elevate privileges by exploiting improper memory handling. The flaw affects multiple Windows 10 versions, including 1607 and later builds up to specific patched versions. The CVSS 3.1 vector indicates low attack complexity, local attack vector, no user interaction required, and high impact on confidentiality, integrity, and availability. Microsoft has published an official fix to address this issue.

An authorized local attacker can exploit this out-of-bounds read vulnerability to elevate their privileges on the affected Windows systems. This could lead to full system compromise, including unauthorized access to sensitive information, modification of system data, and disruption of system availability.

Microsoft has released official patches for all affected versions listed. Applying these updates will remediate the vulnerability. Users and administrators should follow the guidance in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69844 to ensure systems are updated promptly.