CVE-2026-77887: CWE-125: Out-of-bounds Read in Microsoft Windows 10 Version 1607

This vulnerability, tracked as CVE-2026-77887 and classified under CWE-125 (Out-of-bounds Read), affects the Windows DHCP Server in various versions of Microsoft Windows including Windows 10 Version 1607 and others. It allows an attacker with authorized access and high privileges to perform an out-of-bounds read, which can lead to local code execution. The CVSS 3.1 base score is 6.4, indicating medium severity, with attack vector local, high attack complexity, and requiring high privileges. Microsoft has published an official fix for this vulnerability.

Successful exploitation of this vulnerability could allow an authorized attacker with high privileges to execute arbitrary code locally on the affected system. This could lead to full compromise of the affected Windows host, impacting confidentiality, integrity, and availability.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77887. No additional mitigation actions are specified beyond applying the official patch.