CVE-2026-88194: CWE-125: Out-of-bounds Read in Microsoft Windows 10 Version 1607

This vulnerability, identified as CVE-2026-88194 and classified under CWE-125 (Out-of-bounds Read), exists in the Windows DWM Core Library. It allows an authorized attacker with local access to read memory outside the intended bounds, which can be leveraged to elevate privileges on the affected system. The issue affects several Windows 10 versions, including builds starting from 10.0.14393.0 up to but excluding 10.0.14393.9612, and other specified build ranges. Microsoft has published an official fix for this vulnerability.

Successful exploitation of this vulnerability could allow an authorized local attacker to elevate their privileges, potentially gaining higher-level access to the system. The CVSS v3.1 base score is 7.8, indicating high severity with impacts on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88194. No additional mitigations are specified by the vendor.