Windows 10 1607: Out-of-bounds read information disclosure in fdwsd.dll

Summary

An out-of-bounds read in the Function Discovery Service (fdwsd.dll) of Windows 10 Version 1607 and Windows Server 2016 allows an unauthenticated attacker on the network to disclose information. No user interaction or login is required, and the impact is limited to confidentiality (CVSS 3.1: 7.5, HIGH). The leaked data can be useful as a step in a larger attack chain.

Affected

• Windows 10 Version 1607: 10.0.14393.0 before 10.0.14393.9612
• Windows Server 2016: 10.0.14393.0 before 10.0.14393.9612
• Both the full and Server Core installations are affected by the CNA range.

Fixed in

• Build 10.0.14393.9612 or later, per CNA data.
• Release health links this build to the October 2026 cumulative update KB5126868 (released 2026-10-13). Verify the KB and build on the MSRC update guide before rollout.

Workaround

• No vendor-documented workaround found.
• Installing the October 2026 cumulative update is the fix.
• Until patched, limit network access to the host and disable the Function Discovery Service where it is not needed (general hardening, not from the vendor).

Exploitation

• Exploited in the wild: unknown. No KEV listing confirmed for this CVE.
• Public proof of concept: none found.
• CISA SSVC: exploitation none, automatable yes, technical impact partial.
• EPSS is about 0.011 (low predicted exploitation probability).
• Tenable exploit and KEV fields refer to the KB5126868 bundle and cannot be attributed to this CVE.

Our recommendation

• Install the October 2026 cumulative update (KB5126868) on all Windows 10 1607 and Server 2016 hosts in the October cycle, after verifying the build on MSRC.
• Before rollout, check on-premises Exchange servers: Microsoft reports possible email access or sending issues after KB5126868 (status Mitigated).
• Check the Microsoft lifecycle page. If the edition is out of support, plan an upgrade, because no further fixes may be released.
• Restrict network reachability of these hosts, especially on flat LANs or guest Wi-Fi.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-83670 msrc.microsoft.com
• Windows 10 1607 and Windows Server 2016 release health learn.microsoft.com
• Resolved issues Windows 10 1607 learn.microsoft.com
• NVD mirror (Vulners): CVE-2026-83670 vulners.com
• CNA record (Vulners CVELIST): CVE-2026-83670 vulners.com
• OpenCVE: CVE-2026-83670 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 18:48.