Windows SMB Client CVE-2026-69618

Exploitation requires a valid, authenticated local session on the target Windows host (PR:L per CVSS vector). The attacker must be able to initiate SMB client activity from that session - connecting to a file share, triggering an SMB negotiation, or sending a crafted SMB client request. The attack vector is strictly local (AV:L); no remote, unauthenticated path is indicated by the description or CVSS. No non-default configuration is required: the Windows SMB client is enabled by default on all affected platforms. Limiting factors are: the requirement for a local logon (interactive, RDP, or batch/service with local logon rights), the information-disclosure-only impact (no code execution, no persistence via this vulnerability alone), and the unchanged scope (S:U), meaning the disclosure is bounded to the local system.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, Score 5.5) accurately captures the threat: exploitation is low-complexity but strictly local, requiring an authenticated user session with no elevated rights. The High confidentiality rating reflects that kernel-mode out-of-bounds reads can expose sensitive in-memory data - credentials, session tokens, cryptographic material - from adjacent memory regions. Integrity and availability are unaffected, ruling out code execution or denial of service via this vector alone. No CISA KEV listing and no public exploit code have been identified, keeping real-world exploitation likelihood modest. EPSS data was not included in the provided intelligence. The local-access prerequisite substantially narrows the realistic attacker population: this is most pressing in multi-user or multi-tenant environments - shared terminal servers, VDI pools, or developer workstations running untrusted code - where lateral information disclosure within a host matters. Standard enterprise patch cadence is an adequate response given the absence of known active exploitation.

A low-privilege user with a local session on a shared Windows server - such as a terminal services user or a service account with local logon rights - initiates an SMB client connection to a file share in a way that triggers the out-of-bounds read in the SMB client driver. The kernel-mode read leaks contents of adjacent memory, potentially exposing in-memory credentials or session tokens belonging to other processes or the operating system. No public proof-of-concept is currently known, so an attacker would need to independently identify the precise triggering input.