Local denial of service in Windows DHCP Server (CVE-2026-70201) allows an authenticated attacker holding valid low-privilege credentials on a host running the DHCP Server role to crash the service by supplying malformed input that triggers an out-of-bounds read (CWE-125). Per the assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 5.5) the issue is not remotely reachable and yields only availability impact, with no confidentiality or integrity loss and no code execution path. No public exploit identified at time of analysis: CISA SSVC records exploitation as 'none', automatable as 'no', technical impact as 'partial', and the CVE is not KEV-listed; Microsoft has shipped vendor patches, so urgency is low and the main prerequisite is that the DHCP Server role be installed and running (it is not enabled by default on typical member servers).
Information disclosure in the Windows HTTP.sys kernel-mode driver allows a locally authenticated attacker with only low privileges to read data from an uninitialized resource, potentially exposing kernel memory contents that were never cleared before use. Exploitation requires a prior local foothold on an affected host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, base score 5.5) and affects only the pre-patch builds enumerated in EUVD-2026-99961, such as Windows Server 2022 below 10.0.20348.5761, Windows 11 24H2 below 10.0.26100.9711, and Windows Server 2012 below 6.2.9200.26434. Impact is confidentiality-only with no integrity or availability effect, CISA's SSVC framework rates the flaw as non-exploited and non-automatable, and no public exploit identified at time of analysis; Microsoft has released a vendor patch. Real-world priority is therefore low-to-moderate despite HTTP.sys being present in essentially every supported Windows installation.
An out-of-bounds read in the Windows HTTP.sys kernel-mode HTTP stack lets an authenticated local user force the driver to read beyond the bounds of an allocated buffer and disclose sensitive memory contents, rated CVSS 5.5 (AV:L/PR:L/UI:N/C:H/I:N/A:N). Only hosts that already grant an attacker a local foothold with a valid low-privileged account are exposed; remote and unauthenticated attackers are excluded, and no user interaction or special complexity is required once that access exists. There is no confirmed active exploitation (CISA KEV absent) and no public exploit identified at time of analysis, and Microsoft has released fixed builds for all affected Windows client and server versions, so patched systems are not exploitable.
An out-of-bounds read in the Windows Universal Disk Format File System (UDFS) kernel-mode driver lets a locally authenticated attacker disclose information - potentially kernel memory contents - on an affected host. Exploitation requires existing local access and the ability to feed crafted UDF-formatted content (a mounted ISO/UDF image, removable USB media, or a virtual volume) to the driver; the vulnerability is not remotely reachable, cannot be triggered unauthenticated, and has no integrity or availability impact, which is why CISA's SSVC rates it non-exploited and non-automatable. Microsoft has shipped fixed builds for every affected Windows 10, Windows 11, and Windows Server release, and no public exploit code has been identified at time of analysis, making this a moderate-severity, low-priority issue despite affecting a kernel-mode component present by default on all listed platforms.
Information disclosure in the Microsoft Windows NTFS filesystem driver allows a local, low-privileged, authenticated attacker to read portions of kernel memory by triggering an integer underflow (wraparound) during a crafted NTFS operation, with no user interaction required. Exploitation is confined to the local attack vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and yields confidentiality impact only (C:H/I:N/A:N, score 5.5) - there is no write, code-execution, or denial-of-service effect, and CISA's SSVC analysis rates the issue as not automatable with no known exploitation. No public exploit code has been identified at time of analysis, and Microsoft has released a vendor patch covering all affected Windows client and server builds.
Information disclosure in Windows Message Queuing (MSMQ) Queue Manager allows an authenticated local attacker to read data from an affected host via a type confusion flaw. Exploitation requires the optional MSMQ feature to be installed and the Queue Manager service running (not enabled by default), and impact is limited to confidentiality with no code execution or privilege escalation. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Local information disclosure in the Microsoft Windows Search Component lets an authenticated low-privileged user read out-of-bounds memory contents on the affected host, giving a post-foothold attacker a confidentiality-only leak (CVSS 5.5, AV:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability impact. Every current Windows client and server branch is affected - Windows 10 1607/1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012 through 2025 including Server Core - so the exposure is broad even though the flaw cannot be used for remote initial access. No public exploit identified at time of analysis: CISA SSVC records Exploitation: none and Automatable: no, CISA KEV does not list this CVE, and no EPSS signal was provided; urgency is driven by patch hygiene rather than active threat activity. Microsoft has released fixes (see the MSRC update guide referenced below).
Information disclosure in the Windows USB Print Driver allows a locally authenticated, low-privilege attacker to read beyond intended buffer boundaries and leak contents of driver memory on affected Windows 10, Windows 11, and Windows Server builds (2012 through 2025, including Server Core installations). Exploitation requires an existing foothold on the host with the ability to exercise the USB print driver code path (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), needs no victim interaction, and is limited to confidentiality impact - no data modification, no denial of service, and no remote vector. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' with partial technical impact, and an EUVD record (EUVD-2026-99784) tracks the same affected build list; vendor patches are available, making this a genuine but lower-tier patching priority compared with remotely reachable issues.
Out-of-bounds read in Windows Imaging Component (WIC) allows a locally authenticated attacker to disclose in-process memory contents when WIC processes a crafted or attacker-influenced image, with a CVSS of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Affected systems include a broad set of supported Windows 10, Windows 11, and Windows Server builds below their patched build thresholds, and exploitation requires prior low-privileged access to the host rather than remote network reachability. No public exploit identified at time of analysis, CISA SSVC reports exploitation none and automatable no, and Microsoft has released vendor updates to address the flaw.
Information disclosure in Windows Management Instrumentation (WMI) allows an authenticated local attacker to read past the end of an intended buffer, potentially exposing sensitive data held in the memory of the WMI service. The flaw affects a wide span of Windows builds - Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2, including 26H1), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - and requires the attacker to already hold a low-privileged local session on the host (CVSS 3.1 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Impact is confidentiality-only: no data modification, no denial of service, and no remote or unauthenticated path is indicated by the assessed vector. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as none and automatable as no, and Microsoft has released fixed builds for the affected branches.
Local information disclosure in Windows Modern Device Management (MDM) lets an authenticated, low-privileged attacker who already holds a foothold on the host read residual memory contents returned by the MDM subsystem. Rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), this is a local-only, low-complexity, no-user-interaction bug whose sole impact is confidentiality loss - there is no integrity or availability effect and no scope change. Vendor patches are available and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records exploitation as none, automatable as no, and technical impact as partial, which places this in the moderate-priority patch cycle rather than the emergency one.
Information disclosure in Windows Kernel-Mode Drivers on Windows 11 version 26H1 (builds 10.0.28000.0 and later, up to but not including 10.0.28000.3231) lets an authorized attacker who already holds a local low-privilege session read uninitialized kernel memory through a driver interface. The exposure is confined to confidentiality (C:H/I:N/A:N) with no code execution or modification primitive, and the attacker must already be logged on locally, so the issue is a moderate-severity leak rather than a privilege-escalation or remote attack path. There is no public exploit identified at time of analysis, the CISA SSVC assessment records exploitation as none and automatable as no, and Microsoft has published a fix in its update guide.
Information disclosure in Windows Win32k permits a local, authenticated attacker with a standard user session to read kernel memory contents that should be inaccessible, potentially exposing sensitive data. Affected systems include unpatched Windows 10 21H2/22H2/1809, Windows 11 23H2, and Windows Server 2019, 2022, and 2025 builds prior to the listed fixed versions; the flaw is a buffer over-read (CWE-126) requiring local access (AV:L) and low privileges (PR:L), with no remote vector and no user interaction. Vendor patches are available, and no public exploit has been identified at time of analysis; risk is moderate and low-priority despite the CVSS 5.5 base score because confidentiality impact is high but integrity and availability are unaffected.
An out-of-bounds read in the Remote Desktop Display Driver component of Microsoft Windows lets an authenticated, low-privileged local attacker disclose potentially sensitive memory contents on the affected host. Exploitation requires the attacker to already hold a local foothold on the machine (AV:L, PR:L) and to execute code that reaches the driver; no user interaction is needed (UI:N), and the impact is limited to confidentiality (C:H, I:N, A:N) with no code execution or system compromise by itself. No public exploit code has been identified at time of analysis, the flaw is not in CISA KEV, and CISA's SSVC framework rates it non-automatable with only partial technical impact, so real-world urgency is LOW despite the high confidentiality rating.
An out-of-bounds read in the Windows Audio Service (Audiosrv) allows an attacker who already holds authenticated local access with low-level privileges to disclose memory contents from the affected host. The flaw is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning it is strictly a local, post-compromise information-disclosure issue - there is no remote vector, no integrity or availability impact, and no code execution. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records no exploitation activity and marks the issue as not automatable, so this is a genuine but low-urgency issue that should be handled through routine patching rather than emergency response.
Information disclosure in Windows Kernel-Mode Drivers lets an authenticated local attacker read uninitialized kernel memory and leak residual kernel data on affected Windows 10, Windows 11, and Windows Server builds (Windows Server 2012 R2 through 2025). Exploitation requires a pre-existing standard local account and the ability to invoke the vulnerable driver code path; it is not remotely triggerable, needs no user interaction, and provides no code execution or system modification, so realistic value is as a kernel-memory-leak primitive inside a larger exploit chain. No public exploit code or confirmed active exploitation has been identified at time of analysis, and CISA SSVC rates the issue non-automatable, consistent with its low-to-moderate priority despite the CVSS 5.5 Medium score.
An out-of-bounds read in the Windows Key Storage Provider (KSP) allows an authenticated, low-privileged local user to disclose memory contents from the calling process, as rated CVSS 3.1 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only systems running Windows builds below the fixed levels published in the Microsoft update guide and EUVD (for example, Windows 11 24H2 below 10.0.26100.9711 or Windows Server 2025 below 10.0.26100.33650) are affected; patched builds are not exploitable. The issue requires an existing local session and valid credentials, is not remotely reachable, and there is no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, making this a moderate-severity, low-priority issue in practice.
A local information-disclosure flaw in the Windows USB Driver component allows an attacker who already holds authenticated low-privilege access on a Windows host to read past the end of a kernel buffer and leak memory contents back to the caller. Because the CVSS vector is AV:L/PR:L/UI:N, exploitation requires a pre-existing local foothold and direct interaction with the driver on the affected machine; there is no network-reachable attack path and no user interaction is needed once that access exists. Impact is limited to confidentiality (C:H) with no integrity or availability effect, making this an information-leak primitive (useful for defeating ASLR or extracting pointer data) rather than a direct path to code execution, and there is currently no public exploit identified at time of analysis and no CISA KEV listing.
Information disclosure in the Windows StateRepository API permits a locally authenticated low-privileged attacker to read beyond allocated buffers and disclose memory contents on Windows 11 and Windows Server 2025. The flaw requires local code execution with a valid account (PR:L/AV:L) and no user interaction; remote or unauthenticated attackers cannot trigger it directly. No public exploit code or active exploitation is known (CISA SSVC: none), and Microsoft has released patches for all affected builds.
Local information disclosure in the Windows Universal Disk Format File System (UDFS) driver allows an authenticated local attacker to leak memory contents by supplying a crafted UDF-formatted volume - such as a malicious ISO disc image, UDF-formatted removable media, or a mountable disk image - for the driver to parse. Successful exploitation is limited to confidentiality impact (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5), with no code execution, persistence, or denial of service; CWE-822 points to improper handling of an untrusted pointer/offset during parsing. There is no public exploit identified at time of analysis, CISA's SSVC assessment rates the issue as non-automatable with partial technical impact, and vendor-released patches are available, so this is a moderate-severity, low-urgency issue across supported Windows client and server releases.
Information disclosure in Windows Management Instrumentation (WMI) allows an attacker who already holds a local, low-privileged foothold on a Windows host to read memory contents that should not be exposed to them. The flaw is an out-of-bounds read (CWE-125) triggered through a locally reachable WMI code path; no user interaction is required and attack complexity is low once local access exists, but the vector is strictly local and authenticated (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5), with impact limited to confidentiality - no code execution, integrity modification, or denial of service. There is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as 'none'; vendor patches are available and fully updated Windows 10, Windows 11, and Windows Server builds are not exposed.
Information disclosure in the Windows Biometric Service (WbioSrvc) allows a locally authenticated attacker with low privileges to trigger a heap-based buffer overflow and over-read heap memory handled by the service, potentially exposing sensitive data. The flaw affects Windows 10, Windows 11, and Windows Server builds tracked as EUVD-2026-99540 and requires an existing local foothold, with no network vector and no victim interaction; the assessed impact is confined to confidentiality loss with no code execution, integrity, or availability effect. Microsoft has released patches, CISA's SSVC assessment records exploitation as 'none' and automation as 'no', and no public exploit has been identified at time of analysis, making this a moderate-severity, low-urgency fix rather than an emergency.
Out-of-bounds read in the Microsoft Windows Installer component allows an authenticated attacker with low-level local privileges to read memory contents outside intended bounds and disclose information from the affected host. The flaw affects a broad set of Windows client and server builds, including Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1/26H2), Windows Server 2012 through 2025, and their Server Core installations; exploitation requires a pre-existing local foothold, as the assessed vector is AV:L/PR:L with no remote or unauthenticated path, and impact is confined to confidentiality (C:H/I:N/A:N) with no code execution or availability effect. There is no public exploit identified at time of analysis, CISA's SSVC evaluation rates exploitation as none and non-automatable, and the vendor has released fixes, so this is a moderate-severity local disclosure issue rather than an urgent remote threat.
An out-of-bounds read (CWE-125) in the Windows Device Association Service lets an authenticated, low-privileged local user read memory past the end of an allocated buffer and disclose its contents, producing a high confidentiality impact with no integrity or availability effect (CVSS 5.5, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The affected surface covers Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations, but exploitation requires an existing local account/session on the host because there is no network-facing vector and no user interaction is needed. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as none and the flaw as not automatable, and patch availability from Microsoft makes this a moderate, low-urgency remediation item rather than an emergency one.
An out-of-bounds read in the Windows Routing and Remote Access Service (RRAS) allows an attacker who already holds valid credentials for a low-privileged local account to read memory beyond the bounds of an allocated buffer and disclose information from the affected host; no user interaction is required. The exposure is narrowed considerably by two prerequisites: RRAS is a non-default role that must be installed and running, and exploitation requires local access plus low-privileged authentication, so there is no remote or unauthenticated path. Impact is confidentiality-only (high) with no integrity or availability effect, and no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and the activity as not automatable, making this a moderate, low-urgency issue rather than a top patching priority.
An out-of-bounds read in Windows Installer allows an authenticated, low-privileged local user to disclose information from the affected host, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation requires the attacker to already hold a low-privileged local account and the ability to have Windows Installer (msiexec) process a crafted MSI package on that machine; the vulnerability cannot be triggered remotely or by an unauthenticated user, and no victim interaction is required. Impact is bounded to confidentiality - there is no code execution or privilege escalation from this flaw alone, CISA SSVC records exploitation as none, and no public exploit has been identified at time of analysis; a vendor patch is available.
Out-of-bounds memory read in the Windows Device Association Service (DAS) allows a locally authenticated, low-privileged user on Windows 10, Windows 11 and Windows Server 2012 through 2025 to make the service return data past the end of an allocated buffer, disclosing memory contents. The vector (AV:L/PR:L/UI:N, C:H/I:N/A:N) confirms the attacker must already be able to execute code locally and needs no victim interaction, and no public exploit code has been identified at time of analysis; CISA's SSVC rates exploitation as 'none' with partial technical impact and non-automatable, so this is best characterised as a secondary primitive (for example an ASLR or memory-layout bypass) rather than a standalone compromise path. Microsoft has released vendor patches, and because DAS ships enabled by default on all supported Windows editions, every unpatched host in the listed build ranges carries the exposure.
Local information disclosure in the Windows Aggregated Data Platform Service allows an authenticated, low-privileged user on an affected Windows 11 host to read past the bounds of an in-memory buffer and potentially expose sensitive data that the account would not otherwise be entitled to see. Only unpatched Windows 11 builds - 24H2 below 10.0.26100.9711, 25H2 below 10.0.26200.9711, 26H2 below 10.0.26300.9711, and 26H1 below 10.0.28000.3231 - are affected; the CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (5.5) confirms the attacker must already hold a local account and that no integrity or availability impact is possible. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC: Exploitation none, Automatable no), and no EPSS score was supplied; the mandatory local foothold keeps this a moderate-severity, patch-cycle item rather than an emergency.
Information disclosure in Windows Hello allows an authenticated local attacker with low privileges to read out-of-bounds memory and expose potentially sensitive data on affected Windows 10 and Windows 11 systems. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 5.5) confirms a local, authenticated, low-privilege attack with no user interaction and impact limited to confidentiality. CISA SSVC rates exploitation as none and automatable as no; no public exploit was identified at time of analysis, and Microsoft has a vendor patch available.
An out-of-bounds read in the Windows Portable Device MTP (Media Transfer Protocol) driver lets a locally authenticated attacker disclose memory contents from the host, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The attacker must already hold a local account or code-execution foothold on the machine and must be able to present a portable device (physical, emulated, or over a bridged interface) that issues crafted MTP requests to the vulnerable driver; no victim user interaction is required. Exploitation status is limited: CISA SSVC reports no known or expected exploitation and no public exploit code was identified at time of analysis, so this is a routine patch-cycle priority rather than an emergency. A vendor patch is available and the affected build list spans Windows 10, Windows 11, and Windows Server 2012 through 2025.
Local information disclosure in the Windows Container Isolation FS Filter Driver (wcifs) affects supported Windows 10, Windows 11, and Windows Server builds, allowing an attacker who already holds valid low-privileged credentials on the host to read kernel memory that the driver should not expose. Exploitation requires local access and a pre-existing foothold (CVSS 5.5, AV:L/PR:L, confidentiality-only impact), and no public exploit was identified at time of analysis; CISA's SSVC records exploitation as none and the issue as non-automatable. Vendor-released patches are available through Microsoft's monthly update process, and this should be treated as a moderate-severity, low-priority hardening item despite the 'elevate privileges' phrasing used in the title.
An out-of-bounds read in the Microsoft Windows Search Component lets an authenticated attacker with only low-privileged local access cause the component to read past the end of a buffer and disclose information from process memory. Exploitation requires the attacker to already hold local interactive access to the host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and to induce the Search Component to process attacker-influenced input; there is no network or unauthenticated path, and the outcome is memory disclosure only, with no integrity or availability impact. No public exploit code has been identified and CISA's SSVC assessment records exploitation as none, so this is a moderate-severity (CVSS 5.5) local information-disclosure issue with low real-world urgency despite its high confidentiality rating, though the vendor has released fixed builds for all affected Windows editions.
An out-of-bounds read in the Microsoft Windows Search component allows an attacker who is already authenticated on the local machine (CVSS AV:L/PR:L) to disclose information from process memory, with no code execution, integrity, or availability impact (C:H/I:N/A:N) for a base score of 5.5 (MEDIUM). Affected systems are unpatched Windows client and Server builds, including Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025; systems upgraded to the fixed builds (for example Windows 11 24H2 10.0.26100.9711 or Windows Server 2025 10.0.26100.33650) are not affected. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as none and automation as not feasible, and the flaw is not listed in CISA KEV, so this is a low-priority, moderate-severity issue best handled through normal patch cycles rather than emergency response.
Information disclosure in the Windows Broadcast DVR User Service lets a local, authenticated attacker trigger a CWE-126 buffer over-read and leak adjacent memory contents on affected Windows 10, Windows 11, and Windows Server 2019 hosts. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the attacker must already hold low-privilege local access or code execution, no victim interaction is required, and impact is limited to confidentiality - there is no remote attack surface and no integrity or availability effect. There is no public exploit identified at time of analysis, and a vendor-released patch is available from Microsoft.
Information disclosure in the Windows Kernel (CWE-908, use of an uninitialized resource) lets an attacker who already holds code execution under a low-privileged local account read uninitialized kernel memory, producing a high confidentiality impact (CVSS 5.5 / CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability effect. Because the flaw sits in the kernel itself, default installations of the listed Windows 10 and Windows 11 builds, Windows Server 2012 through 2025, and their Server Core variants are affected, but exploitation requires prior local access and credentials rather than remote reach, so it is best treated as one link in a larger local attack chain. Microsoft has released vendor patches for all affected builds, and there is no public exploit identified at time of analysis.
Local information disclosure in the Windows HID Parser Library (CWE-125, out-of-bounds read) affects Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2019/2022/2025, allowing a low-privileged local actor to read memory beyond an intended buffer and potentially disclose sensitive data. Successful exploitation requires local, authenticated access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) plus the ability to get the parser to process attacker-influenced HID descriptor or report data, for example via an attached or emulated USB HID device; integrity and availability are unaffected. The issue is rated moderate rather than high priority: there is no public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and a vendor-released patch is available from Microsoft.
An out-of-bounds read in the Windows HID Parser Library lets a locally present, low-privileged authenticated attacker disclose information from the affected system's memory by supplying a malformed HID descriptor or report to the parser. The flaw is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) and yields confidentiality impact only - no code execution, no privilege escalation, and no integrity or availability effect - though leaked memory contents could assist follow-on attacks. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as 'none' and automatable as 'no', and Microsoft has published a patch; exploitation requires an existing local foothold plus the ability to feed crafted HID data (physical, emulated, or virtual HID device).
Out-of-bounds read in Microsoft PowerPoint allows a local attacker to disclose sensitive information from memory when a victim opens a specially crafted file. This affects Microsoft Office LTSC 2024, Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office for Mac (365, LTSC 2021, and LTSC 2024) prior to the vendor's patched releases. Exploitation requires user interaction to open the malicious document, and no public exploit code or active exploitation has been identified at time of analysis; the impact is limited to information disclosure without code execution or denial of service.
Information disclosure in Microsoft's Windows Projected File System (ProjFS) component allows an authenticated local user to read files or directories that should not be accessible to them, exposing content that the access-control model intended to keep restricted. Exploitation requires the attacker to already hold a local account on the target machine (CVSS PR:L, AV:L) and does not require user interaction, and per CISA's SSVC assessment it is neither actively exploited nor automatable. Affected builds span Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2019/2022/2025 including Server Core installations; no public exploit code has been identified and Microsoft has published fixes in its monthly cumulative updates, so real-world urgency is low and remediation is a routine patch cycle.
Local information disclosure in the Windows Bind Filter (bindflt.sys) driver allows an authenticated local attacker with low privileges to read files outside their intended boundary on unpatched Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 systems. The flaw is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and is a CWE-552 improperly-restricted file/directory access issue in the kernel-mode driver that underpins filesystem bind/redirection mounts. Vendor-released patches are available with fixed builds listed in the EUVD ranges, and no public exploit identified at time of analysis; the SSVC assessment shows exploitation none and not automatable, so risk is moderate and limited to hosts where an attacker already holds a local, authenticated foothold.
An out-of-bounds read in the Windows HID Parser Library (hidparse.sys) allows an attacker who already holds low-privileged local access to read beyond the bounds of a buffer and disclose kernel memory contents to user space, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation is local only - the attacker must be authenticated on the host and must cause the parser to process a malformed HID report descriptor, typically by attaching or emulating a crafted USB or Bluetooth HID device - and the result is read-only information disclosure with no code execution or system modification. No public exploit has been identified at time of analysis, CISA SSVC records no observed exploitation and rates the issue non-automatable with partial technical impact, and a vendor patch is available from Microsoft (MSRC update guide, EUVD-2026-100040).
An out-of-bounds read in the Windows HID Parser Library lets an authenticated, low-privileged local attacker disclose information from the host by inducing the parser to process a malformed or attacker-influenced HID report or descriptor, yielding a CVSS v3.1 score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only confidentiality is affected - there is no integrity or availability impact - and because the vector requires PR:L and AV:L, an attacker must already hold a local authenticated session, making this a post-compromise or malicious-insider concern rather than a remotely reachable one. Vendor patches are available and no public exploit has been identified at time of analysis, and CISA's SSVC assessment records exploitation as none and automatable as no, reinforcing a moderate-severity, low-priority rating in practice.
Out-of-bounds read in the Windows HID Parser Library lets an attacker who already holds authenticated local access to a Windows host read beyond the bounds of a parser buffer by supplying a crafted or emulated HID input (for example a malicious USB HID device or a malformed HID report descriptor), resulting in local information disclosure. The affected component is only reachable after local authentication and requires attacker-controlled HID traffic, and the outcome is limited to confidentiality loss (C:H) with no integrity or availability impact and no scope change, so this is a genuine but comparatively low-urgency issue. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as "none" and the issue as non-automatable, and vendor-released patches are available in the form of the Windows build updates listed below.
Local information disclosure in the Windows Desktop Window Manager (DWM) lets an attacker who already holds low-privileged code execution on a host trigger a buffer over-read and harvest out-of-bounds memory contents from the desktop compositor that is present and running by default on every affected system. The issue is reachable only with local access at low privilege and requires no user interaction, so it cannot be leveraged remotely or used on its own to gain code execution, escalate privileges, or cause a denial of service. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation, and because the impact is limited to confidentiality (CVSS 5.5, C:H/I:N/A:N), this is assessed as a medium-severity, low-priority issue despite the ubiquity of the affected product; all supported Windows 10, Windows 11, and Windows Server builds below the fixed build numbers in Microsoft's update guide are affected.
An out-of-bounds read in the HID Parser Library shipped with Microsoft Windows allows an attacker who already holds local access and low-level privileges on the host to disclose information from kernel memory. The flaw is reachable when the parser processes a malformed HID report descriptor, which can come from an attacker-controlled USB or Bluetooth HID device or from a local process feeding crafted HID data; CVSS 3.1 scores it 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning confidentiality impact only with no integrity or availability effect. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC exploitation: none, automatable: no), and Microsoft has published a vendor patch through the MSRC update guide, so urgency is moderate and local in scope.
Incorrect authorization in Windows Hello allows a locally positioned attacker who already holds high privileges on the host (CVSS PR:H) to bypass the Windows Hello security feature and read data that the feature is meant to protect, resulting in a confidentiality-only impact (C:H, I:N, A:N) and a base score of 4.4. The flaw is local-only (AV:L), low complexity (AC:L), and requires no user interaction (UI:N), so it presupposes pre-existing elevated access to the machine and that Windows Hello is actually in use as the bypassed control; unpatched Windows 10 21H2/22H2 and Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 builds are affected. There is no CISA KEV entry and no public exploit code identified at time of analysis, and Microsoft has published vendor patches that resolve the affected builds via the MSRC update guide.
Local tampering in the Windows Container Isolation FS Filter Driver (unionfs.sys) lets an authenticated attacker redirect file operations to an attacker-chosen destination. A low-privileged user who can create or control a symbolic link, junction, or reparse point that unionfs.sys resolves during a file operation can exploit improper link resolution (CWE-59) to modify or overwrite files the driver handles, affecting Windows 11 24H2, 25H2, 26H1 and 26H2 plus Windows Server 2022 and 2025 builds prior to their patched levels. The flaw is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), meaning local authenticated access is a prerequisite and only integrity is impacted; no public exploit code has been identified and CISA's SSVC assessment records exploitation as none and automatable as no, so real-world urgency is low.
Information disclosure in the Windows NTFS file system driver allows an authenticated local attacker to read sensitive system information that should be restricted to a higher privilege level. The flaw affects Windows 10, Windows 11, and Windows Server installations on NTFS volumes below their respective patched builds; exploitation requires pre-existing local code execution or interactive access as a low-privileged user (CVSS PR:L), with no remote vector and no user interaction (UI:N). No public exploit code has been identified at time of analysis, and Microsoft has released vendor patches.
Local information disclosure in the Windows Remote Access Connection Manager (RASMAN) service (CVE-2026-70137, CVSS 5.5) allows an attacker who already holds a low-privileged local account to invoke functionality that lacks an adequate access-control check and thereby read data they are not entitled to see. Exploitation is strictly local (AV:L/PR:L/UI:N), requires an existing valid session on the target, and results only in confidentiality loss (C:H) with no integrity or availability impact; the same architecture is shared across the affected Windows client and server builds listed in the EUVD dataset. There is no confirmed active exploitation (CISA SSVC reports Exploitation: none, and the CVE is not in KEV) and no public exploit code has been identified at time of analysis, so this is a moderate-severity post-compromise/insider-risk hardening issue rather than a remotely reachable threat. Vendor patches are available from Microsoft in the fixed build numbers published in the MSRC update guide.
Information disclosure in Microsoft Windows kernel-mode drivers allows an attacker who already holds a low-privileged local account to read data they are not authorized to access, stemming from an incorrect authorization check (CWE-863) rather than a memory-safety bug. Only local access is required (AV:L, PR:L) with no user interaction (UI:N), and the impact is confined to confidentiality (C:H) with no integrity or availability effect, giving a moderate CVSS 3.1 base score of 5.5. Microsoft has released fixes through the MSRC update guide covering Windows 11 24H2/25H2/26H1/26H2 and Windows Server 2025 (including Server Core); there is no public exploit identified at time of analysis, no CISA KEV listing, and CISA's SSVC assessment records exploitation as none and automatable as no.