CVE-2026-96245: CWE-125: Out-of-bounds Read in Microsoft Windows 10 Version 1607

This vulnerability (CWE-125) is an out-of-bounds read in the Windows Routing and Remote Access Service (RRAS) affecting multiple Windows 10 versions including 1607 and later builds. An attacker without privileges or user interaction can exploit this flaw remotely to disclose sensitive information. The CVSS v3.1 base score is 7.5, indicating high severity due to network attack vector, low attack complexity, no privileges required, and no user interaction. Microsoft has released an official fix for this issue.

Successful exploitation allows an unauthorized attacker to read memory outside the intended bounds in the RRAS component, leading to information disclosure over the network. This could expose sensitive data but does not allow code execution or system disruption. The vulnerability affects confidentiality but not integrity or availability.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96245. No additional mitigations are required once the patch is applied.