CVE-2026-72989: CWE-908: Use of Uninitialized Resource in Microsoft Windows 10 Version 1809

This vulnerability, identified as CWE-908 (Use of Uninitialized Resource), exists in the Windows Failover Cluster feature of Microsoft Windows 10 Version 1809. It allows an attacker without privileges or user interaction to potentially disclose sensitive information remotely by exploiting uninitialized resources. The CVSS v3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability affects Windows 10 builds >=10.0.17763.0 and <10.0.17763.9245, >=10.0.20348.0 and <10.0.20348.5622, and >=10.0.26100.0 and <10.0.26100.33438. Microsoft has published an official fix for this issue.

An unauthorized attacker can remotely exploit this vulnerability to disclose sensitive information from the affected Windows Failover Cluster systems. The impact is limited to confidentiality loss; integrity and availability are not affected. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft Security Response Center advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72989). No additional mitigation actions are specified or required beyond applying the official patch.