Windows SMB CVE-2026-49801

Exploitation requires the attacker to hold a valid local or domain user account with interactive or network logon rights on the target system (CVSS PR:L confirmed). The vulnerability is triggered through the Windows SMB stack via a local code path - the CVSS AV:L vector confirms this is not remotely exploitable over the network in the traditional sense; the attacker must have local execution context. No elevated privileges (Administrator or SYSTEM) are required. No user interaction from a second user is needed. The limiting factors are: (1) local or equivalent access is a hard prerequisite - remote unauthenticated attackers cannot reach this code path; (2) impact is strictly read-only (C:H, I:N, A:N), meaning an attacker cannot modify data or cause denial of service through this vector alone; (3) SSVC rates the vulnerability as not automatable, indicating the exploitation sequence requires deliberate targeting. No special non-default SMB configuration is stated as required - any system running the affected SMB stack with a locally authenticated user present is theoretically in scope.

The CVSS 3.1 base score of 5.5 (Medium) is consistent with the local, low-privilege, information-disclosure-only profile: AV:L limits exposure to authenticated system users, AC:L indicates no race condition or complex setup is required, PR:L confirms a standard non-admin user account suffices, and S:U means the scope is contained within the affected system. C:H is significant - uninitialized memory in an SMB handler could expose cryptographic keys, credentials, or other sensitive kernel-resident data. However, the real-world prioritization signals are uniformly low: EPSS sits at 0.31% in the 22nd percentile, indicating that fewer than one in three hundred systems in the observed telemetry base are experiencing exploitation attempts; the vulnerability is absent from the CISA KEV catalog; and CISA SSVC scores exploitation as 'none' with technical impact 'partial' and automatable 'no'. Together these signals indicate this is a genuine vulnerability worth patching in the normal patch cycle but does not warrant emergency remediation. The local attack vector is the primary limiting factor - an attacker must already have code execution as a low-privileged user, reducing the realistic attacker pool significantly. No conflicting signals are present between the CVSS vector and the description.

A low-privileged local user - such as a domain user with an interactive desktop session on a shared workstation or a terminal server - triggers the vulnerable SMB code path through a crafted local IPC or loopback request, causing the SMB handler to return an uninitialized memory buffer. The attacker reads the returned data, which may contain fragments of kernel memory including session tokens, cached credentials, or cryptographic key material resident in memory at the time of the request. No public exploit code has been identified at the time of analysis, and SSVC assesses the vulnerability as not automatable, suggesting exploitation requires deliberate, targeted effort rather than commodity tooling.