CVE-2026-70584: CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') in Microsoft Windows 10 Version 1607

This vulnerability (CVE-2026-70584) involves a type confusion issue (CWE-843) in the Windows Core Messaging component of Microsoft Windows 10. It allows an authorized local attacker to elevate privileges by accessing resources using incompatible types. The vulnerability affects multiple Windows 10 versions starting from build 14393 up to various later builds before the respective fixed versions. The CVSS 3.1 base score is 7.8, indicating high severity with impacts on confidentiality, integrity, and availability. Microsoft has released official patches to address this issue.

Successful exploitation allows an authorized local attacker to elevate privileges, potentially gaining higher system rights. This can lead to full system compromise, including unauthorized access to sensitive information and disruption of system availability. The vulnerability does not require user interaction and has low attack complexity but requires local access and privileges to exploit.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as listed in the vendor advisory. No additional mitigation steps are indicated beyond applying the official patches.