CVE-2026-69989: CWE-416: Use After Free in Microsoft Windows 10 Version 1607

This vulnerability (CVE-2026-69989) is a use-after-free issue in the DNS Server of Microsoft Windows 10 Version 1607 and other specified versions. An attacker can exploit this flaw remotely without privileges or user interaction to execute arbitrary code. The CVSS 3.1 base score is 8.1, indicating high severity, with network attack vector, high attack complexity, no privileges required, and no user interaction needed. The vulnerability impacts confidentiality, integrity, and availability. Microsoft has published an official fix for affected versions.

Successful exploitation allows remote code execution by an unauthorized attacker over the network, potentially leading to full system compromise including confidentiality, integrity, and availability impacts. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69989. No additional mitigations are specified by the vendor.