Local information disclosure in the Windows Clipboard User Service lets an authenticated attacker who already holds a low-privileged foothold on the host read sensitive system information the service is meant to keep segregated (CVSS 3.1 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only confidentiality is affected - integrity and availability are untouched - and exploitation requires valid local credentials, so it cannot be reached remotely or by an unauthenticated actor. Microsoft has published fixes for all supported Windows client and server branches; no public exploit code exists and there is no confirmed active exploitation (CISA SSVC exploitation: none, automatable: no, technical impact: partial), making this a moderate, low-priority hardening item.
Local information disclosure in the Windows Universal Disk Format file system driver (UDFS, udfs.sys) allows an authenticated low-privilege attacker to read out-of-bounds memory by supplying a maliciously crafted UDF volume - a rogue optical disc, ISO/UDF disk image, or removable/mounted device - that the targeted host then mounts and parses. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (5.5): exploitation requires an existing local authenticated session, there is no remote vector and no victim user interaction, and impact is confined to confidentiality with no integrity or availability loss. Microsoft has shipped fixes per its advisory, CISA's SSVC assessment rates exploitation as 'none' with automatable exploitation 'no' and partial technical impact, and no public exploit code was identified at time of analysis - making this a genuinely moderate, low-urgency issue rather than a top-tier priority.
Local information disclosure in the Microsoft Windows Trace Data Helper component allows an attacker who already holds low-privileged credentials and code-execution or interactive access on a Windows host to read sensitive system information that should be outside their authorization boundary (CVSS 3.1 base 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Every unpatched supported Windows release is affected - Windows 10 from 1607 through 22H2, Windows 11 from 23H2 through 26H2, and Windows Server 2012 through 2025 - so the exposure condition is simply running an unpatched build. Exploitation status signals are benign: CISA SSVC records Exploitation: none and Automatable: no, there is no KEV listing and no public exploit identified at time of analysis, although an information-disclosure bug of this class can be reliably triggered once an attacker is already on the box, making it a post-compromise or malicious-insider amplifier rather than a remote entry point. Vendor-released patches are available from Microsoft for all affected builds.
A local information disclosure flaw in the Microsoft Trace Data Helper component of Windows allows a low-privileged, already-authenticated user to read sensitive system data they should not be able to access. Affected platforms span Windows 10, Windows 11, and Windows Server 2012 through 2025, where an attacker with an existing local session can trigger the component without any user interaction and with low attack complexity. No public exploit code has been identified and CISA's SSVC assessment records no exploitation activity, so this is a genuine but moderate-priority issue rather than an emergency; vendor patches are available for all listed builds.
Local information disclosure in the Windows Kernel allows an authenticated, low-privileged attacker who already has code execution on the host to read sensitive system information that should be outside their control sphere. The flaw affects unpatched Windows 10 and Windows 11 client builds and Windows Server 2012 through 2025 (including Server Core installations) below the vendor-specified fixed build numbers, and carries a CVSS v3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning high confidentiality impact but no integrity or availability impact. Exploitation requires an existing local foothold and low-privileged credentials, cannot be triggered remotely or without authentication, and no public exploit identified at time of analysis; a vendor-released patch is available.
Local information disclosure in Windows Kernel allows an authenticated low-privileged user to read sensitive system information from kernel memory. Affected are all supported unpatched Windows builds from Windows Server 2012 through Windows Server 2025 (including Server Core) and Windows 10/11 versions up to 26H2, as listed in EUVD-2026-99871. Exploitation requires a prior local foothold and authentication (PR:L); no public exploit identified at time of analysis, and a vendor patch is available.
Local information disclosure in Windows Cryptographic Services lets an authenticated attacker who already holds a low-privileged account on a Windows host read sensitive system data outside their authorized control sphere. Rated CVSS 5.5 (AV:L/PR:L/UI:N, C:H/I:N/A:N) and classified as CWE-497, the flaw requires an existing local foothold and cannot be triggered remotely or without credentials, which concentrates realistic risk on shared, multi-user, and Remote Desktop/terminal-server hosts and on post-compromise reconnaissance. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the EUVD data set covers Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, and vendor patches are available.
Information disclosure in the Windows iSCSI component lets an attacker who already holds a low-privileged local account on an affected host read sensitive system information that should be outside its control sphere, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, CWE-497). Affected platforms span Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025 including Server Core installations, and Microsoft has released a vendor patch via the MSRC update guide for CVE-2026-69644. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as 'none' and the issue as non-automatable, so this is a hands-on-keyboard, confidentiality-only leak that matters mainly on shared or multi-user hosts.
Information disclosure in the Windows HTTP.sys kernel-mode driver allows a locally positioned attacker who already holds low-privileged code execution on a target host to read sensitive system memory information that should be restricted to a higher privilege sphere. The flaw requires local access and existing low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 5.5), needs no user interaction, and affects default installations of the listed Windows client and server builds because HTTP.sys is a core OS component; a remote, unauthenticated attacker cannot trigger it directly. Exploitation is assessed as none by CISA SSVC, no public exploit code has been identified at time of analysis, and Microsoft has shipped vendor fixes - making this a moderate, low-urgency hardening item rather than an emergency patch.
Local information disclosure in the Windows Client Side Caching driver (csc.sys) lets an authenticated attacker who already holds low-level privileges on a Windows host read sensitive data that should be restricted, such as contents of the Offline Files cache. The flaw affects default installations across Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, and requires only local access with no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5). There is no public exploit identified at time of analysis, CISA's SSVC rates exploitation as 'none' and the issue as non-automatable with partial technical impact, and Microsoft has released patched builds - making this a post-compromise disclosure primitive rather than a remote entry point.
Information disclosure in the Microsoft Windows Storage component lets an authenticated local attacker read sensitive data that the service places in a file or directory reachable by lower-privileged users (CWE-538). Exploitation requires a valid low-privileged interactive session on an unpatched host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), so it cannot be triggered remotely or by an unauthenticated user, and the impact is confidentiality-only (C:H, I:N, A:N) with a base score of 5.5. Microsoft has released fixes, CISA's SSVC assessment rates exploitation as 'none' with automatable 'no', and no public exploit code has been identified at time of analysis, making this a moderate-severity hardening item rather than an urgent remote threat.
Information disclosure in Windows Kernel-Mode Drivers lets a locally authenticated user with only low-level privileges read sensitive information that the driver writes into its log files, affecting a broad range of Windows client and server releases from Windows Server 2012 through Windows 11 26H2 and Windows Server 2025. The flaw is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so it is strictly local, requires prior authentication, needs no victim interaction, and causes only confidentiality loss on a host the attacker has already accessed. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as none and the issue is not automatable, and Microsoft has released patched builds for all affected editions, making real-world urgency low despite the high confidentiality sub-score.
Local information disclosure in the Windows Sysmain service allows an authenticated attacker with low-level local privileges to access sensitive system information on unpatched Windows 10, Windows 11, and Windows Server builds. Exploitation requires existing local access and valid credentials (CVSS PR:L), with no user interaction needed, and is limited to confidentiality impact; no public exploit identified at time of analysis, and CISA SSVC records no exploitation. Microsoft has released vendor patches for the affected builds via its MSRC advisory.
A local information-disclosure flaw in the Windows Common Log File System (CLFS) kernel driver allows an attacker who already holds low-privileged local access on a Windows host to trigger a buffer over-read and read beyond the bounds of a kernel buffer, exposing memory contents (CVSS 5.5, C:H/I:N/A:N). Exploitation requires local authenticated access (AV:L/PR:L) with no user interaction, but does not yield code execution or system compromise; the attack surface is strictly local. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and Microsoft has released patched builds addressing the affected CLFS driver versions.
Information disclosure in the Windows Kernel (CVE-2026-108462) allows an attacker who already holds local, low-privileged access to read sensitive system data they are not authorized to see, affecting the full range of supported Windows 10, Windows 11 and Windows Server releases from Server 2012 through Server 2025, including Server Core installations. Scoring 5.5 (Medium) under the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, it requires authenticated local access, needs no user interaction, and produces only a confidentiality impact, so it is realistically a post-foothold capability rather than a remote or unauthenticated entry point. Microsoft has published fixes through the vendor advisory, and no public exploit code has been identified at time of analysis.
Local information disclosure in Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025 lets anyone who already holds a local user session read private personal information they should not be able to access, yielding a HIGH confidentiality impact (CVSS 6.2, CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability effect. The flaw is not remotely reachable and requires no authentication or user interaction beyond the local foothold, so the practical exposure is limited to hosts where an attacker has already gained local code execution on an unpatched build. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC reports Exploitation: none, Automatable: no), and the moderate score plus the local-only vector point to LOW real-world urgency even though the data disclosed is sensitive.
Server-side request forgery in Conductor OSS through 3.33.0-rc10 lets remote attackers influence the kafka_request.bootStrapServers argument handled by KafkaPublishTask.start in the Kafka contrib module, causing the Conductor server to connect to an attacker-chosen Kafka bootstrap endpoint. The issue is CWE-918; VulDB rates it CVSS 4.0 5.5, while our independent assessment uses CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:N/C:L/I:L/A:L and characterizes the practical impact as low, with publicly available exploit code existing but CISA KEV active exploitation not indicated in the provided data. Although the CVSS vector is PR:N, practical exploitation requires that the Kafka contrib module is deployed, that a usable KafkaPublishTask exists, and that the attacker can create or execute a workflow/task controlling the bootstrap-servers argument, so deployments that enforce authentication/authorization on workflow submission or are not internet-exposed are substantially less exposed.
Local information disclosure in the Windows Update Orchestrator Service allows an authenticated attacker with low-level privileges to read files they could not otherwise access by exploiting a link-following flaw (CWE-59). The attacker must create a symbolic link or junction in a location resolved by the privileged service, which then accesses the linked file with higher privileges. This vulnerability affects various unpatched Windows 10, Windows 11, and Windows Server versions; Microsoft has released patches, and no public exploit identified at time of analysis (CISA SSVC exploitation: none). CVSS 5.5 (Medium) reflects the local-only, authenticated vector with confidentiality-only impact.
Local information disclosure in the Microsoft Windows Projected File System (ProjFS) component allows an authenticated, low-privileged attacker with local access to read data they should not be able to reach, most plausibly by traversing outside the intended projection root (CWE-22). Impact is confidentiality-only (CVSS 5.5, AV:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability effect, and there is no network vector or user-interaction requirement, so it is a post-access or insider-style step rather than a remotely reachable entry point. No public exploit has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none and automatable as no; Microsoft has released fixes.
Local information disclosure in the Windows Backup Engine allows an attacker who already holds valid low-privileged local access to a Windows host to create a symbolic link or NTFS junction in a filesystem path processed by the backup engine, so that a subsequent backup or restore operation resolves the link and discloses the contents of a protected target file the attacker could not normally read. The flaw is rated 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting that it is not remotely reachable, requires authentication and local logon, needs the Windows Backup Engine component to actually be invoked, and yields confidentiality impact only - with no integrity or availability effect - on unpatched Windows 10 21H2/22H2 and Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 builds below the fixed version levels recorded in EUVD. There is no public exploit identified at time of analysis: CISA SSVC records exploitation as 'none' and automatable as 'no', and no KEV listing or POC reference appears in the supplied intelligence. A vendor-released patch is available, making this a moderate, low-priority local information-disclosure flaw rather than a widespread emergency.
Improper link resolution in the Windows Update Orchestrator Service allows a locally authenticated, low-privileged attacker to read files they would not otherwise be permitted to access on Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2022/2025. Because the service runs as SYSTEM and dereferences filesystem paths without validating reparse points, an attacker who already holds a foothold can plant a symbolic link, junction or hard link and race the service into opening a protected file, yielding high-confidentiality information disclosure with no integrity or availability impact (CVSS 5.5). Exploitation is assessed as non-automatable under CISA's SSVC framework, no public exploit code has been identified at time of analysis, and overall risk is comparatively low-priority given the local, post-compromise prerequisites.
Local information disclosure in the Windows Win32K kernel-mode subsystem allows an attacker who already holds a low-privileged, authenticated local session to trigger a use of uninitialized resource and read memory contents that should not be exposed to their privilege level. The flaw is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and is confidentiality-only: it does not by itself grant code execution, privilege escalation, or persistence, but the leaked data can be used to defeat memory-layout protections and support a follow-on attack. Affected platforms span Windows 10, Windows 11, and Windows Server 2012 through 2025 (including Server Core) at default configuration, with no special feature or non-default setting required. Microsoft has released fixed builds through the MSRC update guide; there is no public exploit code and CISA's SSVC decision framework records exploitation as 'none', so no public exploit identified at time of analysis.
An out-of-bounds read in the Windows Error Reporting (WER) component of affected Windows client and server builds lets an attacker who already holds low-privileged local access on the host read memory beyond the bounds of an allocated buffer, resulting in disclosure of potentially sensitive information from the affected process's address space. The flaw carries a CVSS v3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and is classified under CWE-125, meaning the sole impact is confidentiality - the bug cannot by itself modify data or cause a denial of service. There is no public exploit identified at time of analysis; CISA's SSVC assessment records Exploitation as "none" and Automatable as "no", and CISA KEV does not list this issue. This is a genuinely moderate, low-priority issue rather than an urgent threat: the attack surface is local-only, requires existing authenticated access and the ability to drive the vulnerable code path through WER, and yields information disclosure rather than code execution.
Local information disclosure in the Windows NTFS driver lets an authenticated, low-privileged user trigger an out-of-bounds read that exposes kernel memory contents on unpatched Windows 10, Windows 11 and Windows Server builds. The issue is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning it is only reachable after an attacker already has a local foothold on the host, and it yields confidentiality impact alone with no integrity or availability effect. Microsoft has published a vendor patch, CISA's SSVC evaluation records no exploitation and no automation, and no public exploit code has been identified at time of analysis, so this is a genuine but low-urgency issue that matters mainly as a post-compromise or chained-attack primitive rather than a standalone remote threat.
Local information disclosure in the Windows Print Spooler allows an authenticated, low-privileged user (CVSS PR:L, AV:L) to read memory beyond the bounds of a buffer handled by the printing subsystem, which runs by default on Windows client and server editions. Affected builds are Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 that predate the fixed build levels published in the vendor update (for example Windows 11 24H2 before 10.0.26100.9711 and Windows Server 2025 before 10.0.26100.33650). The issue is rated CVSS 5.5 with confidentiality-only impact (C:H/I:N/A:N) and no user interaction required; there is no public exploit identified at time of analysis and CISA SSVC records no exploitation activity, making this a moderate-severity, low-priority issue under real-world scrutiny, with vendor patches available.
Information disclosure in the Windows Event Logging Service allows an authenticated, low-privileged local user to read leftover uninitialized memory from the service, potentially exposing data belonging to other processes or system structures. Every listed Windows 10 and Windows 11 release and Windows Server 2012 through 2025 edition (including Server Core installations) is affected below its patched build number, but exploitation requires the attacker to already have a valid local account plus the ability to execute code on the host - it cannot be triggered remotely or without credentials. Microsoft has published fixes through the MSRC update guide, no public exploit identified at time of analysis, CISA's SSVC decision framework records exploitation as none and automatable as no, and the assessed 5.5 CVSS reflects confidentiality-only impact with no integrity or availability effect.
Information disclosure via use of an uninitialized resource in the Microsoft Windows Event Logging Service allows a locally authenticated attacker holding only low privileges (PR:L) to read stale memory contents from the affected service, yielding high confidentiality impact with no integrity or availability effect (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only hosts running unpatched builds of Windows 10, Windows 11, and Windows Server 2012 through 2025 within the version ranges listed in the EUVD advisory are affected, and the flaw cannot be reached remotely - an attacker must already have local code execution and a valid session on the target. Exploitation is not automatable per SSVC (Exploitation: none, Automatable: no, Technical Impact: partial), and no public exploit is identified at time of analysis, so real-world urgency is LOW despite the HIGH confidentiality rating; vendor patches are available that eliminate the condition.
An out-of-bounds read in the Microsoft Windows Search Component lets a locally authenticated, low-privileged attacker read memory adjacent to search operations, resulting in information disclosure without any user interaction. Impact is confined to confidentiality (C:H) with no integrity or availability effect, and exploitation requires an existing local session on an affected Windows 10, Windows 11, or Windows Server build - there is no remote or unauthenticated path. No public exploit code and no confirmed active exploitation have been identified (CISA KEV absent; SSVC exploitation: none), and the vendor has released fixed builds, so this is a low-to-moderate priority patch-and-move-on issue rather than an emergency.
Null pointer dereference in the Windows Audio Service allows an authenticated, low-privileged local user to disclose information on affected Windows 10, Windows 11, and Windows Server 2012 through 2025 systems. Exploitation requires the attacker to already hold a low-privileged account on the host and to run code locally that interacts with the audio service (CVSS 3.1 AV:L/PR:L, no user interaction), so there is no remote or unauthenticated attack path and confidentiality is the only impacted property. There is no public exploit identified at time of analysis, CISA's SSVC assessment rates exploitation as none and automatable as no, and the vendor has released fixes, making this a moderate-severity, low-priority issue primarily relevant to multi-user or shared-endpoint environments where local users should not be able to read information they do not own.
Local information disclosure in Windows Encrypting File System (EFS) allows an authenticated attacker with a low-privileged local account to trigger a buffer over-read and leak sensitive data from affected Windows builds, including Windows 10, Windows 11, and Windows Server editions. Exploitation requires local access and cannot be triggered remotely; there is no public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation as none and automatable as no. Successful exploitation yields high confidentiality impact only, with no integrity or availability impact, making this a moderate-priority patching target for systems with untrusted local users.
Out-of-bounds read in the Windows Win32 kernel subsystem (win32k) lets an attacker who already holds a low-privileged local account on a Windows host read kernel memory it should not be able to access, resulting in information disclosure only (CVSS 3.1 5.5, AV:L/PR:L/UI:N, C:H/I:N/A:N). Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. There is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none with no automation, while Microsoft has shipped a vendor patch; the practical risk is bounded by the requirement for an existing foothold, since the flaw cannot be reached remotely or without local code execution.
Out-of-bounds read in the Windows Win32 Kernel Subsystem lets a locally authenticated attacker holding low-privilege execution rights read beyond the bounds of a kernel buffer and disclose memory contents on affected Windows 10, Windows 11, and Windows Server builds; no user interaction is required. Scoring 5.5 (Medium) under CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, the flaw is an information-leak primitive only - it provides no direct code execution or privilege escalation, and its value depends on being chained with a separate escalation or KASLR-bypass technique. There is no public exploit identified at time of analysis, and Microsoft has shipped fixes for all listed build families via the MSRC update guide.
Uninitialized kernel memory disclosure in the Windows Win32 kernel subsystem affects Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through Server 2025, and requires the attacker to already hold local, low-privileged code execution on the target host. Exploitation returns uninitialized kernel memory to the caller, giving a high confidentiality impact (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability loss, which makes it chiefly valuable as a kernel memory/address-leak primitive that augments a separate exploit rather than a standalone compromise. There is no public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no with partial technical impact, and Microsoft has published a vendor patch through the MSRC update guide.
Local information disclosure in the Windows Win32 kernel subsystem (win32k) allows an attacker who already holds low-privileged, authenticated local access to read protected kernel memory and potentially disclose sensitive data. Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012 through 2025, including Server Core installations. Microsoft has released fixes through its update guide, and there is no public exploit identified at time of analysis; the vulnerability is not listed in CISA KEV and CISA's SSVC assessment rates exploitation as none and automation as no, so real-world urgency is LOW and the flaw is confined to post-compromise scenarios rather than initial access.
Local information disclosure in the Windows Win32 Kernel Subsystem (CVE-2026-70284) allows an authenticated attacker who already holds low-privileged code execution on the host to read uninitialized kernel memory and potentially expose sensitive data, rated CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with CWE-908. The flaw is strictly local (AV:L), requires low privileges (PR:L), needs no user interaction, and has no remote or network component; CISA's SSVC records Exploitation: none and Automatable: no, and no public exploit code or KEV activity has been identified at time of analysis. Impact is confined to confidentiality - there is no integrity or availability effect - so despite affecting an extremely broad set of Windows client and server builds, this is a moderate-priority hardening/patching item rather than an urgent one.
Local information disclosure in the Windows Device Association Service (the component that handles device pairing and association) allows an attacker who already holds low-privileged, authenticated access on a Windows host to read out-of-bounds memory and potentially expose sensitive data. Microsoft rates this CVSS 3.1 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting a local-only vector with no user interaction, no integrity or availability impact, and unchanged scope. There is no public exploit identified at time of analysis and CISA's SSVC assessment records no exploitation activity, so this is a moderate, low-priority issue best handled through routine patching rather than emergency response.
Information disclosure in Windows Win32k allows an authenticated local attacker with low privileges to trigger an out-of-bounds read in the kernel-mode Win32 subsystem, potentially exposing sensitive kernel memory contents. The CVSS 5.5 rating reflects a local-only attack path (AV:L/PR:L) with no user interaction and no direct integrity or availability impact, so the flaw cannot be used for initial access and is most relevant as an info-leak primitive within a larger local exploit chain. Vendor patches are available, and no public exploit code or active exploitation has been identified at time of analysis.
Information disclosure from an out-of-bounds read in the Windows Remote POS Driver allows an authenticated local user to read memory past the boundary of an intended buffer, potentially exposing sensitive data handled in kernel context. Exploitation requires local access with low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), needs no user interaction, and is limited to confidentiality impact - no integrity or availability effect - which caps real-world severity despite the HIGH confidentiality rating. No public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC: Exploitation = none, Automatable = no), and the requirement for pre-existing local authenticated access is the principal factor reducing risk.
Information disclosure in Microsoft Windows Netlogon allows an attacker who already holds valid low-privilege credentials and local access on a host to read uninitialized memory through the Netlogon code path, potentially exposing residual data from prior process or kernel memory (CWE-908). Per the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) the flaw is not remotely reachable and requires a pre-existing foothold, but no user interaction is needed and confidentiality impact is rated High; integrity and availability are unaffected. There is no public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and vendor patches are available for the affected Windows client and server builds.
An out-of-bounds read in the Windows DNS component lets a locally authenticated, low-privileged attacker cause the service to read past the end of an allocated buffer and leak information from process memory, giving high confidentiality impact with no integrity or availability effect (CVSS 3.1 base 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation requires an attacker to already hold local, authenticated low-privileged access to an affected Windows host - there is no remote or network-triggerable path - and no public exploit code has been identified at time of analysis, with CISA SSVC recording exploitation as 'none' and automatable as 'no'. Affected builds span Windows Server 2012 through Windows Server 2025 and Windows 10 versions 1607 and 1809, and Microsoft has released fixed builds for each, making this a moderate, low-priority patching item rather than an urgent emergency.
Information disclosure in the Windows CD-ROM driver (cdrom.sys) lets an attacker who already holds a low-privileged local session on a Windows host read past the bounds of an allocated buffer in kernel memory, exposing data they should not be able to see. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 5.5), the flaw is local-only, requires prior authenticated access, needs no victim interaction, and is confined to confidentiality impact - it cannot alter data or crash the system, so remote and unauthenticated attackers cannot use it directly. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft has released fixed builds across Windows 10/11 and Windows Server 2012 through 2025, making this a moderate, low-priority item despite the ubiquity of the affected platform.
Local information disclosure in Windows Secure Kernel Mode (the Virtualization-Based Security / VTL1 secure kernel) affects Windows 10, Windows 11 from 23H2 through 26H1/26H2, and Windows Server 2019, 2022, and 2025. An attacker who already holds authenticated low-privileged local code execution on the host can force a type-confused resource access in the Secure Kernel path and read data they should not be able to reach, resulting in high-confidentiality impact with no integrity or availability effect. There is no remote or network-facing vector and no user interaction; no public exploit code has been identified at time of analysis, CISA's SSVC rates exploitation as 'none' with automability 'no', and Microsoft has released patched build updates.
An out-of-bounds read in the Windows IP Over USB Service (the component that exposes IP connectivity to devices over USB, typically used by device and SDK tooling rather than being a default always-on service) lets an attacker who already holds low-privileged local credentials read beyond intended memory boundaries and disclose information. According to the assessed CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, this is a local, authenticated, no-user-interaction information disclosure with high confidentiality impact but no integrity or availability impact, and there is no remote vector, privilege escalation, or code execution. There is no public exploit identified at time of analysis and CISA's SSVC assessment rates exploitation as none with the issue not automatable; this is a moderate-severity, low-priority issue rather than an urgent one, and vendor patches are available.
Information disclosure in the Microsoft Windows Update component allows a local, low-privileged authenticated attacker (CVSS AV:L/PR:L, UI:N) to trigger an out-of-bounds read and expose contents of process memory. Only specific Windows 11 builds (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025 - including Server Core - below the fixed build numbers are affected; the flaw cannot be reached remotely or by an unauthenticated actor, and impact is limited to confidentiality (C:H) with no integrity or availability effect and no code execution or privilege escalation on its own. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as 'none', and vendor patches are available, making this a moderate, low-priority issue when all signals are weighed together.
Local information disclosure in the Windows Overlay Filter (WOF) component of supported Windows client and server releases allows an authenticated attacker who already holds a foothold on the host to read memory beyond an allocated buffer, potentially leaking kernel or process memory contents. Exploitation requires local access as a low-privileged user (CVSS:3.1/AV:L/PR:L/UI:N) and the ability to exercise the WOF code path used for file-system compression and overlay operations; the outcome is confidentiality-only (C:H, I:N, A:N) with no code execution, integrity, or availability impact. No public exploit code or active exploitation has been identified at time of analysis (SSVC exploitation: none, automatable: no), and a vendor patch is available, so the practical risk is that of a moderate information-leak primitive that could be chained into a broader exploit rather than a standalone compromise.
An authenticated local attacker can trigger an out-of-bounds read (CWE-126) in the Windows Overlay Filter (WCIFS) driver and disclose the contents of adjacent kernel memory on affected Windows 10, Windows 11 and Windows Server builds. The flaw is only reachable from an existing interactive foothold on the host with at least low user privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) and results in confidentiality loss only, with no integrity or availability effect. There is no public exploit identified at time of analysis, CISA's SSVC rates exploitation as 'none' and the issue as non-automatable, and Microsoft has shipped fixed builds for all listed products.
Local information disclosure in Windows Cryptographic Services (CryptSvc) allows an attacker who already holds authenticated, low-privileged access to the host to trigger an out-of-bounds read and leak bytes from process memory, potentially including cryptographic material handled by the service. Only Windows Server 2025 (including Server Core installations) and Windows 11 24H2, 25H2, 26H1, and 26H2 builds older than the vendor-fixed build numbers are affected; Microsoft has released patches, and no public exploit identified at time of analysis. The CVSS 3.1 score of 5.5 (AV:L/PR:L/UI:N, high confidentiality impact only) alongside a CISA SSVC rating of no exploitation and not automatable places real-world urgency at a low level.
An out-of-bounds read (CWE-125) in the Windows AppX Deployment Service allows an attacker who already holds an authenticated, low-privileged local session on a Windows host to read past the bounds of a memory buffer and disclose information to which they should not have access. The issue is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so it requires local access and valid credentials but no user interaction, and it affects only confidentiality - there is no integrity or availability impact and no privilege escalation is described. Exploitation has not been observed (CISA SSVC exploitation: none) and there is no public exploit identified at time of analysis; vendor patches are available, so this is a moderate-severity, low-urgency item that should be resolved through routine monthly patching rather than emergency action.
An out-of-bounds read (CWE-125) in the Windows iSCSI component allows a locally authenticated, low-privileged attacker to disclose sensitive memory contents from the affected host, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation is strictly local: the attacker must already hold valid low-privileged credentials on the machine and reach the vulnerable iSCSI code path - no remote or unauthenticated vector and no victim interaction are involved, and the impact is confidentiality-only, with no code execution, integrity, or availability loss on its own. Vendor-released patches are available through Microsoft's MSRC update guide, and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; the primary risk is as a memory-disclosure/ASLR-bypass primitive chained into a larger local attack rather than a standalone compromise.
Heap corruption in the Windows Kernel lets an attacker who already holds local, low-privileged code execution on a target host escalate to higher privileges; the authoritative assessment scores this CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning full confidentiality, integrity and availability impact on the compromised machine, while NVD's published base score of 5.5 reflects availability impact only. All supported Windows 10 (21H2 and 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2022/2025 builds below the vendor-fixed levels are affected, and exploitation requires an existing local, authenticated foothold as a low-privileged user (PR:L, AV:L) with no user interaction (UI:N) and low complexity (AC:L) beyond reaching the vulnerable kernel code path. Microsoft has shipped patches per its update guide, CISA's SSVC decision framework records exploitation as none, and no public exploit code has been identified at time of analysis, so this is a moderate-priority post-compromise escalation primitive rather than an initial-access or remotely reachable flaw.