CVE-2026-70290: CWE-908: Use of Uninitialized Resource in Microsoft Windows 10 Version 1607

This vulnerability (CVE-2026-70290) arises from the use of an uninitialized resource within the Windows Win32 Kernel Subsystem, which can be exploited by an authorized local attacker to disclose information. It affects various builds of Windows 10 Version 1607 and related versions, as detailed by the affected version ranges. The CVSS 3.1 base score is 5.5, indicating medium severity, with an attack vector limited to local access, low attack complexity, and requiring low privileges. The impact is limited to confidentiality loss without integrity or availability impact. Microsoft has issued an official fix for this vulnerability.

An authorized local attacker can exploit this vulnerability to disclose sensitive information due to the use of an uninitialized resource in the Windows kernel subsystem. The confidentiality impact is high, but there is no impact on integrity or availability. The attack requires local access with low complexity and privileges.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions to remediate this vulnerability. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70290 for detailed update information and guidance.