Windows CryptoAPI CVE-2026-55144

Exploitation requires the attacker to already hold a low-privileged authenticated local account on the target (PR:L, AV:L) and to invoke or influence a CryptoAPI operation that omits the required cryptographic step; no user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: the attacker must have a pre-existing local foothold - this cannot be triggered remotely or unauthenticated - and the affected platforms are limited to Windows 11 24H2/25H2/26H1 and Windows Server 2022/2025. The precise API call path or configuration that reaches the flawed routine is not detailed in the supplied data and should be confirmed against the MSRC advisory.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N describes a local (AV:L), low-complexity attack that requires some existing privileges (PR:L) and no user interaction, yielding high confidentiality and integrity impact but no availability impact - a 7.1 High. This is a meaningful but not emergency-tier issue: the local attack vector and authentication requirement bound blast radius to attackers who already have a foothold, which is a strong mitigating factor. No EPSS score, SSVC decision, POC, or KEV entry was supplied, so there is no signal of active or automatable exploitation; exploitation appears to require targeted local access rather than mass remote abuse. One inconsistency to verify: the Microsoft tag labels this 'Information Disclosure' while the description emphasizes 'tampering' (integrity), yet the supplied vector marks both C:H and I:H - the combined impact framing is plausible but the primary impact class should be confirmed against the MSRC advisory.

An attacker who has already obtained a low-privileged local account on a Windows 11 or Windows Server 2025 host abuses the missing cryptographic step in CryptoAPI to forge or alter data that the system treats as cryptographically validated. Because AC:L and UI:N, once local access is held the manipulation is reliable and requires no victim interaction; no public exploit code is currently identified.