CVE-2026-85859: CWE-476: NULL Pointer Dereference in Microsoft Windows 10 Version 1607

This vulnerability, identified as CWE-476 (NULL Pointer Dereference), exists in the Windows Message Queuing Queue Manager component of Microsoft Windows 10 Version 1607 and related builds. An authorized attacker can exploit this flaw remotely over a network to cause a denial of service by triggering a null pointer dereference, leading to system instability or crash. The CVSS v3.1 base score is 6.5, indicating a medium severity level. The vulnerability affects multiple Windows 10 versions starting from build 10.0.14393.0 up to but not including various patched builds such as 10.0.14393.9612 and others. Microsoft has released official patches to address this issue.

Successful exploitation results in denial of service (DoS) due to a null pointer dereference in the Windows Message Queuing Queue Manager. There is no impact on confidentiality or integrity, only availability is affected. The attacker must be authorized and can perform the attack remotely over a network.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85859 to remediate this vulnerability. No additional mitigations are specified or required beyond applying the official patch.