CVE-2026-85815: CWE-125: Out-of-bounds Read in Microsoft Windows 10 Version 1607

CVE-2026-85815 is a vulnerability classified as CWE-125 (Out-of-bounds Read) in the Windows Device Association Service. It affects various builds of Microsoft Windows 10, including version 1607 and later versions up to specific build numbers before patches were applied. The vulnerability allows an authorized attacker with local access to read memory outside the intended bounds, potentially disclosing sensitive information. The CVSS v3.1 base score is 5.5, reflecting a medium severity with local attack vector, low attack complexity, and requiring low privileges but no user interaction. Microsoft has published an official fix for this vulnerability.

An authorized local attacker can exploit this vulnerability to read memory beyond the intended boundaries in the Windows Device Association Service, leading to potential disclosure of sensitive information. There is no impact on integrity or availability. No known exploits are reported in the wild at this time.

Microsoft has released an official fix for CVE-2026-85815. Users and administrators should apply the relevant security updates as provided in the Microsoft Security Response Center advisory to remediate this vulnerability.