CVE-2026-84001: CWE-125: Out-of-bounds Read in Microsoft Windows 10 Version 1607

This vulnerability (CVE-2026-84001) is an out-of-bounds read issue classified under CWE-125 affecting the Windows Key Distribution Center in multiple versions of Microsoft Windows 10, including Version 1607 and later builds. The flaw allows an attacker without privileges or user interaction to trigger a denial of service condition remotely over the network. The CVSS 3.1 base score is 7.5, reflecting high severity due to network attack vector, low attack complexity, no privileges required, and no user interaction needed. The impact is limited to availability (denial of service) with no confidentiality or integrity impact. Microsoft has released an official fix for this vulnerability as documented in their security update guide.

An attacker can remotely cause a denial of service on affected Windows 10 systems by exploiting an out-of-bounds read in the Windows Key Distribution Center. This disrupts system availability but does not compromise data confidentiality or integrity. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as listed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84001. No additional mitigation steps are indicated by the vendor.