CVE-2026-85794: CWE-125: Out-of-bounds Read in Microsoft Windows 10 Version 1607

This vulnerability involves an out-of-bounds read in the Windows Routing and Remote Access Service (RRAS) component. It permits an authorized local attacker to read memory outside the intended bounds, potentially disclosing sensitive information. The issue affects various builds of Windows 10, including Version 1607 and later builds up to specific patched versions. Microsoft has published an official fix to address this vulnerability.

An authorized attacker with local access can exploit this vulnerability to disclose information from memory that should not be accessible, potentially leading to information leakage. There is no indication of impact on integrity or availability. The vulnerability does not require user interaction and has limited attack complexity.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85794.