CVE-2026-69853: CWE-908: Use of Uninitialized Resource in Microsoft Windows 10 Version 1607

This vulnerability (CWE-908) arises from the use of an uninitialized resource in the Windows Win32K subsystem. It affects multiple Windows 10 versions starting from build 10.0.14393.0 up to but excluding various patched builds (e.g., <10.0.14393.9512, <10.0.17763.9245, <10.0.19044.7725, etc.). An authorized attacker with low privileges can locally exploit this flaw to disclose sensitive information. The CVSS 3.1 base score is 4.7, reflecting medium severity with local attack vector, high attack complexity, and low privileges required. Microsoft has released an official fix for this vulnerability.

Successful exploitation allows an authorized local attacker to disclose information from the affected system. The vulnerability does not allow privilege escalation, integrity compromise, or availability impact. The attack complexity is high, and user interaction is not required.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as listed in the vendor advisory. No additional mitigation is required once the patch is applied.