CVE-2026-96861: CWE-125: Out-of-bounds Read in Microsoft Windows 10 Version 1607

This vulnerability (CVE-2026-96861) is an out-of-bounds read flaw in the Network Device Enrollment Service (NDES) component of Microsoft Windows 10 Version 1607. An attacker without privileges can exploit this flaw remotely over a network to cause a denial of service condition. The CVSS 3.1 base score is 7.5, reflecting high severity due to network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability affects multiple Windows 10 builds and related versions as specified, and Microsoft has released official fixes to remediate the issue.

The vulnerability allows an unauthorized attacker to cause a denial of service (availability impact) on affected Windows 10 systems via the NDES component. There is no impact on confidentiality or integrity. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96861. Applying these patches will remediate the vulnerability and prevent exploitation.