CVE-2026-72952: CWE-125: Out-of-bounds Read in Microsoft Windows 10 Version 1809

CVE-2026-72952 is an out-of-bounds read vulnerability in the Windows Spaceport.sys driver that affects Windows 10 Version 1809 and later builds. This vulnerability enables an authorized attacker with local access to execute arbitrary code on the system. The flaw is identified as CWE-125 and has a CVSS 3.1 base score of 7.0 (high severity), reflecting high impact on confidentiality, integrity, and availability. Multiple Windows 10 versions are affected, with patches released by Microsoft to remediate the issue. No known exploits are reported in the wild at this time.

Successful exploitation allows an authorized local attacker to execute arbitrary code, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability of the affected Windows 10 systems.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72952. No additional mitigation steps are required beyond applying the official patches.