Windows DirectX CVE-2026-49807

An attacker must have local code execution on the target system - whether via physical access, a remote desktop session, or a previously executed payload - but requires no special account privileges; the CVSS PR:N metric indicates that any execution context, including potentially low-integrity or sandboxed processes, can invoke the vulnerable DirectX code path. Exploitation is limited to Windows versions below the patched build thresholds confirmed by EUVD. There is no network-accessible attack surface: the vulnerability cannot be triggered remotely without a pre-existing foothold. No special DirectX feature enablement or non-default configuration is identified as a prerequisite, as DirectX is active by default on all affected Windows editions. The absence of any integrity or availability impact (I:N/A:N) means exploitation is confined to information theft and will not crash or modify the target system.

The CVSS 6.2 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) presents a nuanced risk profile. The high confidentiality impact (C:H) is partially offset by the local attack vector (AV:L), restricting exploitation to systems where an adversary already has some form of local presence - physical, RDP, or a running process. The PR:N metric, unusual for a local vector, suggests any execution context can trigger the flaw without elevated privileges, lowering the practical barrier for a post-foothold attacker. EPSS at 0.38% (30th percentile) is low, and SSVC independently rates Exploitation as 'none' and Automatable as 'no', with only partial technical impact - all three signals converge on this being a real but deprioritized threat. The absence of CISA KEV listing confirms no observed active exploitation at the time of reporting. The most realistic risk is an attacker who has already achieved code execution on a target system using this flaw to harvest sensitive in-memory data (credentials, cryptographic material) as part of a lateral movement or privilege escalation chain. Standalone, without prior access, this vulnerability poses no direct threat.

An adversary who has already obtained a foothold on a Windows endpoint - via phishing, an initial-access vulnerability, or compromised credentials - runs an unprivileged local process that invokes specially crafted DirectX API calls to trigger the information disclosure. The process reads sensitive data from DirectX-managed memory (such as kernel pointers, GPU buffer contents, or cross-process data fragments), providing material useful for defeating ASLR, forging tokens, or extracting cryptographic keys as part of a broader privilege escalation chain. No public proof-of-concept code has been identified at time of analysis.