CVE-2026-96924: CWE-822: Untrusted Pointer Dereference in Microsoft Windows 10 Version 1607

CVE-2026-96924 is a critical security vulnerability classified as CWE-822 (Untrusted Pointer Dereference) affecting multiple builds of Microsoft Windows 10, including Version 1607 and later updates. The flaw exists in the Windows Object Linking and Embedding (OLE) component, enabling remote code execution by an attacker over a network without any user interaction or privileges. The vulnerability has been assigned a CVSS v3.1 base score of 9.8, reflecting its critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. Microsoft has issued official patches to address this vulnerability, as documented in their security update guide.

Successful exploitation of this vulnerability allows an attacker to remotely execute arbitrary code on affected Windows systems, potentially leading to full system compromise. The attacker does not require any privileges or user interaction, increasing the risk of widespread exploitation. The vulnerability impacts confidentiality, integrity, and availability of the affected systems.

Microsoft has released official security updates that fix this vulnerability. It is strongly recommended to apply these patches promptly to all affected Windows 10 versions as listed in the advisory. No additional mitigation steps are indicated by the vendor advisory.