CVE-2026-96857: CWE-552: Files or Directories Accessible to External Parties in Microsoft Windows 10 Version 1809

This vulnerability (CVE-2026-96857) involves files or directories being accessible to external parties due to a flaw in the Windows Projected File System on Windows 10 Version 1809 and related builds. An authorized attacker with local privileges can exploit this to disclose sensitive information. The CVSS 3.1 base score is 5.5 (medium), reflecting local attack vector, low complexity, and no user interaction required. The vulnerability affects multiple Windows 10 builds from 10.0.17763.0 up to but not including various patched builds (e.g., <10.0.17763.9376). Microsoft has issued an official fix for this vulnerability.

The vulnerability allows local authorized attackers to disclose sensitive information by accessing files or directories that should not be accessible externally. There is no impact on integrity or availability. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96857. No additional mitigation actions are required beyond applying the official patch.