CVE-2026-88116: CWE-822: Untrusted Pointer Dereference in Microsoft Windows 10 Version 1607

This vulnerability (CVE-2026-88116) is classified as CWE-822: Untrusted Pointer Dereference, occurring in the DNS Server component of Microsoft Windows 10 Version 1607 and related builds. It enables an unauthorized attacker to execute arbitrary code remotely by exploiting improper handling of pointers. The vulnerability has a CVSS v3.1 base score of 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts confidentiality, integrity, and availability. Microsoft has published an official fix for affected versions.

Successful exploitation allows remote code execution by an unauthorized attacker over the network, potentially leading to full system compromise including confidentiality, integrity, and availability impacts. This could enable attackers to run arbitrary code with system privileges on affected Windows 10 systems running vulnerable DNS Server versions.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88116. No additional mitigations are indicated by the vendor advisory.