CVE-2026-97836: CWE-125: Out-of-bounds Read in Microsoft Windows 10 Version 1607

This vulnerability (CWE-125) involves an out-of-bounds read in the DNS Server on affected Windows 10 versions. An authorized attacker can exploit this flaw to disclose sensitive information over a network. The vulnerability affects multiple Windows 10 builds starting from version 10.0.14393.0 up to but not including various patch versions listed. The CVSS 3.1 vector indicates network attack vector, low attack complexity, and requires privileges but no user interaction, with high confidentiality impact and no integrity or availability impact. Microsoft has published an official fix to address this issue.

An authorized attacker can leverage this out-of-bounds read vulnerability to disclose information over the network, potentially exposing sensitive data. There is no impact on integrity or availability. No known exploits are reported in the wild at this time.

Microsoft has released an official fix for this vulnerability. Users and administrators should apply the provided security updates as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97836 to remediate this issue.