Windows Device Health Attestation CVE-2026-69443

No special conditions are required beyond network access to the Device Health Attestation service: exploitation is unauthenticated, requires no user interaction, and no non-default configuration is needed per the CVSS vector AV:N/AC:L/PR:N/UI:N. The primary limiting factor is network topology - the DHA service is typically consumed by enterprise MDM infrastructure and may be shielded from direct internet exposure by firewalls or network segmentation. Exploitation is limited to Windows 10 Version 1809, Windows Server 2019, Server 2022, and Server 2025 builds below the patched thresholds listed in the affected versions. Systems already patched to the fixed builds are not affected.

The CVSS 7.5 score (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a high-confidentiality, network-exploitable flaw with no authentication barrier and low complexity - a meaningful priority in server environments. However, real-world risk is bounded by deployment context: the DHA service is primarily used in enterprise MDM scenarios and may not be directly internet-exposed in well-segmented networks, which reduces opportunistic mass exploitation potential. Impact is strictly limited to information disclosure; integrity and availability are unaffected, and scope is unchanged. No EPSS score was provided in the input, and the vulnerability is not listed in the CISA KEV catalog. No public exploit code has been identified. The 'Buffer Overflow' tag in the input metadata is a mislabel - CWE-125 is an out-of-bounds read, a read-side issue, not a write overflow; analysts should not interpret the tag as implying potential code execution. Overall priority is moderate-to-high for Internet-facing Windows Server deployments running affected builds, but lower for air-gapped or strictly segmented environments.

An unauthenticated attacker with network access to an unpatched Windows Server sends a specially crafted request to the Device Health Attestation service, triggering an out-of-bounds read in the buffer-parsing logic. The service responds with memory contents beyond the intended buffer boundary, potentially leaking sensitive process memory such as cryptographic material, credentials, or internal state. No public exploit code exists at time of analysis, but the low complexity and no-auth requirements make future exploit development straightforward.