EUVD-2026-35596
GHSA-25wx-66jf-2p4j
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose information locally.
AnalysisAI
Information disclosure in Windows Shell exposes sensitive data to authenticated low-privileged attackers, with a confirmed vendor patch available. The vulnerability stems from CWE-200 improper information exposure within the Windows Shell component, allowing confidentiality compromise with no integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high confidentiality impact score (C:H) and low attack complexity elevate practical concern for environments where lateral movement or credential harvesting are threat vectors.
Technical ContextAI
Windows Shell is the core user interface layer of Microsoft Windows, responsible for the desktop environment, file system browsing, process execution, and inter-process communication surfaces. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) identifies the root cause as a failure to properly restrict access to data that should be protected - in this context, Windows Shell likely fails to enforce access controls on sensitive objects, environment variables, file paths, registry entries, or tokens it processes. The CVSS vector specifies CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating a network-reachable attack path requiring low-privilege credentials. However, the CVE description explicitly states the disclosure occurs 'locally,' which is a direct conflict with the AV:N vector - this discrepancy must be resolved with vendor confirmation before assessing remote exploitability.
RemediationAI
The primary remediation is to apply the vendor-released patch from Microsoft available via the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42907. An exact patched version number was not included in the available intelligence data; consult the MSRC advisory to confirm the specific KB article and build. If immediate patching is not feasible and the actual attack vector is confirmed as local (per the description), restrict interactive and remote login access to the affected systems to only trusted, necessary user accounts, minimizing the pool of low-privilege principals who could trigger the disclosure. If the AV:N vector is accurate and the vulnerability is remotely exploitable, consider restricting network access to Windows Shell-adjacent services (e.g., RPC endpoints, SMB, RDS) from untrusted network segments as a compensating control. Note that network segmentation is a partial mitigation only and does not substitute for patching.
More in Windows 10 1809
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows contains an elevation of privilege vulnerability known as 'HiveNightmare' or 'SeriousSAM' where overly permissiv
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today