CVE-2026-96925: CWE-191: Integer Underflow (Wrap or Wraparound) in Microsoft Windows 10 Version 1607

This vulnerability involves an integer underflow (wrap or wraparound) in the Windows NTFS file system component. It affects multiple builds of Windows 10, including Version 1607 and later builds up to specific patched versions. The flaw allows an attacker with local authorized access to cause information disclosure. The vulnerability has been assigned CVE-2026-96925 and is tracked under CWE-191. Microsoft has published an official fix to address this issue.

An authorized local attacker can exploit this integer underflow vulnerability to disclose sensitive information on affected Windows 10 systems. The vulnerability does not allow for privilege escalation, denial of service, or integrity compromise based on the provided data. The CVSS vector indicates low attack complexity and privileges required, with no user interaction needed, and a high impact on confidentiality.

Microsoft has released an official fix for this vulnerability. Users and administrators should apply the security updates provided by Microsoft to the affected Windows 10 versions to remediate this issue. Since an official fix is available, no additional mitigation steps are required beyond patching.