CVE-2026-88112: CWE-822: Untrusted Pointer Dereference in Microsoft Windows 10 Version 1607

This vulnerability, identified as CWE-822 (Untrusted Pointer Dereference), exists in the DNS Server component of Microsoft Windows 10 Version 1607 and other specified builds. It allows an attacker without privileges to execute arbitrary code remotely by exploiting how the DNS Server handles pointers. The CVSS v3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. Microsoft has published an official fix to address this issue.

Successful exploitation could allow an attacker to execute arbitrary code remotely on affected Windows 10 systems, potentially leading to full system compromise, including complete confidentiality, integrity, and availability impacts. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88112. No additional mitigations are specified beyond applying the official patches.