Xbox Windows Component CVE-2026-78455

Physical access to the target machine is required - the CVSS AV:P vector is the primary limiting condition, making remote exploitation impossible. User interaction (UI:R) is additionally required, meaning the attack likely requires the target session to be active or a user to trigger some device operation. No authentication is needed (PR:N), so any bystander with hands-on access could attempt exploitation. Limiting factors: the attacker must be physically present at the device; the exploit is not automatable (SSVC: Automatable: no); impact is read-only information disclosure with no integrity or availability consequence. Exploitation risk is highest in environments where untrusted individuals have physical proximity to Windows machines with Xbox-related components active (kiosks, shared gaming stations, open offices).

Real-world risk is moderate-to-low despite the CVSS 4.3 score, primarily because AV:P constrains exploitation to actors with physical device access - a scenario that already implies a serious security perimeter breach. SSVC rates exploitation as none and automatable as no, consistent with AV:P. Technical impact is partial (confidentiality only; I:N, A:N). EPSS data was not provided, and the vulnerability is not listed in CISA KEV, meaning no evidence of active exploitation exists at time of analysis. The high C:H impact metric reflects that whatever memory region is read could be highly sensitive, but the severity is bounded by the physical prerequisite. Priority should be elevated for shared or publicly-accessible endpoints (kiosk machines, gaming labs, conference rooms) where physical access by untrusted parties is plausible, and deprioritized for secured enterprise workstations with strict physical access controls.

An attacker with brief physical access to an unattended Windows workstation connects a crafted Xbox peripheral or manipulates an Xbox-related interface, triggering an out-of-bounds read in the Xbox driver. The driver reads memory beyond its allocated buffer and surfaces the contents to the attacker, potentially exposing cryptographic material or process memory. No public exploit code exists at time of analysis; the physical prerequisite makes opportunistic mass exploitation impractical.