CVE-2026-97843: CWE-125: Out-of-bounds Read in Microsoft Windows 10 Version 1607

This vulnerability (CVE-2026-97843) involves an out-of-bounds read in the DNS Server of Microsoft Windows 10 Version 1607 and other specified versions. An authorized attacker can exploit this flaw to disclose information over a network. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, high confidentiality impact, no integrity or availability impact, with official remediation and confirmed fix. The affected versions include multiple Windows 10 builds from 6.2.9200.0 up to but excluding specific patched builds such as 10.0.14393.9612 and others. Microsoft has published an official advisory and provided patches for this vulnerability.

An authorized attacker can exploit this out-of-bounds read vulnerability to disclose sensitive information over the network. The confidentiality impact is high, but there is no impact on integrity or availability. There are no known exploits in the wild at this time.

Microsoft has released official patches for this vulnerability. Users and administrators should apply the available updates as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97843 to remediate this issue.