Windows QoS Scheduler CVE-2026-50431

Exploitation requires local authenticated access with at minimum a standard (low-privileged) user account on the target system - confirmed by CVSS PR:L and AV:L. No network-facing attack surface exists; an attacker must be able to execute code locally, whether through an interactive logon, RDP session, or an already-running local process. No special Windows configuration, specific feature enablement, or non-default setting is identified in the available data as a prerequisite. What limits exploitation: the requirement for pre-existing local code execution eliminates remote unauthenticated attack scenarios entirely; SSVC 'Automatable: no' indicates the attack cannot be scripted for mass exploitation; and the impact is read-only (confidentiality only), so no direct system takeover is possible from this flaw alone.

The CVSS 3.1 score of 5.5 (Medium) is consistent with a local-only, read-only information disclosure - no integrity or availability impact and no network reachability. The vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates low complexity and no user interaction once local access is achieved, but the local attack vector is the primary limiting factor. EPSS at 0.47% (38th percentile) reflects a low probability of exploitation in the wild within 30 days, consistent with SSVC's 'Exploitation: none' and 'Automatable: no' classification. This is not a remote attack surface and is not in CISA KEV. No public exploit code has been identified. In practice, this vulnerability is most dangerous as a post-exploitation tool - an attacker who already has local access could use the information disclosure to stage privilege escalation or exfiltrate network configuration secrets. The partial technical impact rating from SSVC is accurate: this flaw alone does not enable takeover, but the high confidentiality impact rating (C:H) means the exposed data could be highly sensitive.

An attacker who has obtained a low-privileged shell on a Windows system - through a phishing payload, compromised service account, or RDP brute force - calls into the QoS Packet Scheduler kernel driver via a vulnerable interface to read restricted memory regions or internal data structures. The disclosed information could include network configuration data, credentials cached in kernel memory, or details useful for planning a subsequent privilege escalation. No public exploit code has been identified at time of analysis.