CVE-2026-96948: CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere in Microsoft Windows 10 Version 1607

This vulnerability (CVE-2026-96948) affects multiple versions of Microsoft Windows 10, including Version 1607 and later builds up to specific patch levels. It is caused by exposure of sensitive information to an unauthorized control sphere within the Windows Client Side Caching driver (csc.sys). The flaw allows an authorized attacker with local access to disclose sensitive system information. The CVSS v3.1 base score is 5.5 (medium), reflecting local attack vector, low complexity, low privileges required, no user interaction, and high confidentiality impact without integrity or availability impact. Microsoft has published an official fix for this vulnerability.

An authorized local attacker can disclose sensitive system information due to this vulnerability. There is no impact on system integrity or availability. The confidentiality impact is high, meaning sensitive information could be exposed to unauthorized actors locally. No known exploits in the wild have been reported.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96948. No additional mitigation actions are specified or required beyond applying the official patch.