CVE-2026-83989: CWE-125: Out-of-bounds Read in Microsoft Windows 10 Version 1607

CVE-2026-83989 is an out-of-bounds read vulnerability classified as CWE-125 in the Windows Services for NFS ONCRPC XDR Driver. This flaw allows an attacker without privileges or user interaction to cause a denial of service condition remotely. The vulnerability affects various Windows 10 builds starting from version 10.0.14393.0 up to but not including certain patch versions (e.g., <10.0.14393.9512, <10.0.17763.9245, <10.0.19044.7725, etc.). Microsoft has published an official fix addressing this issue.

The vulnerability enables an unauthorized attacker to remotely cause a denial of service (DoS) on affected Windows 10 systems by triggering an out-of-bounds read in the NFS ONCRPC XDR Driver. There is no impact on confidentiality or integrity, but availability is affected. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83989. No additional mitigation actions are indicated by the vendor.