Windows Push Notifications CVE-2026-42969

Exploitation requires a locally authenticated account with standard (low-privileged) user rights on the target system - confirmed by the CVSS vector AV:L/PR:L. The Windows Push Notifications service must be active; this service runs by default on Windows 10 and Windows 11 consumer and enterprise editions, but its availability on Windows Server Core installations (which are included in the affected version list) should be verified per deployment. No network access, elevated privileges, or user interaction are required once local authenticated access is established. Exploitation is limited to confidentiality impact only - no code execution or persistence is achievable through this vulnerability alone. The local access requirement (AV:L) is the primary limiting factor: remote or unauthenticated attackers cannot trigger this vulnerability directly.

The CVSS 5.5 medium score reflects the constrained attack surface: AV:L requires physical or logical local access, PR:L requires a valid low-privileged account, and S:U means the vulnerability cannot pivot to affect other system components directly. These factors meaningfully limit the realistic population of attackers. However, C:H indicates that when exploited, confidentiality impact is severe - full read of exposed memory rather than partial leakage. No EPSS score was provided in the source data, so exploitation probability cannot be quantified. There is no CISA KEV listing and no known public exploit code, indicating this is not currently under active opportunistic exploitation. The breadth of affected Windows versions (from 1607 to 26H1, covering essentially all supported and recently end-of-life Windows releases) makes patching high-priority in environments with untrusted local users - shared workstations, terminal server environments, or systems with contractor or guest accounts. For single-user endpoints with fully trusted local users, operational risk is lower. SSVC assessment: exploitation status = none, automatable = no (local access required), technical impact = partial (confidentiality only) - suggesting defer/scheduled patching in most enterprise contexts unless shared-access environments elevate urgency.

An attacker who has obtained a standard low-privileged Windows account - through credential theft, social engineering, or insider access - invokes the Push Notifications API on an unpatched system to trigger the uninitialized resource read path, capturing residual heap or stack memory contents that may include authentication tokens, session data, or other sensitive artifacts left by previously executing processes. No public proof-of-concept code has been identified, so exploitation would currently require independent vulnerability research to identify the precise triggering condition within the Push Notifications subsystem.