CVE-2026-78451: CWE-822: Untrusted Pointer Dereference in Microsoft Windows 10 Version 1809

This vulnerability, identified as CWE-822 (Untrusted Pointer Dereference), exists in the Microsoft Windows SCSI Class System File. It allows an attacker with physical access to the system to exploit improper pointer handling, leading to privilege escalation. Multiple Windows 10 versions are affected, specifically those versions starting from 10.0.17763.0 up to but not including various fixed builds (e.g., <10.0.17763.9245, <10.0.19044.7725, etc.). Microsoft has released official fixes for this issue, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow an attacker with physical access to the affected Windows 10 systems to elevate their privileges, potentially gaining high-level control over the system. The CVSS 3.1 score of 6.8 reflects a medium severity with high impact on confidentiality, integrity, and availability. However, remote exploitation is not indicated, and user interaction is not required.

Microsoft has provided official fixes for this vulnerability. It is recommended to apply the security updates provided by Microsoft for the affected Windows 10 versions as listed in the vendor advisory. No additional mitigation steps are indicated beyond applying the official patches.