Windows EFS CVE-2026-83565

Exploitation requires the attacker to already hold an authenticated local account on the target host (CVSS PR:L, AV:L) and to invoke Windows Encrypting File System (EFS) functionality that triggers the over-read; EFS is present by default on affected Windows editions. Limiting factors: there is no remote vector and no privilege escalation (S:U, I:N), so an attacker must first gain local low-privileged access; no user interaction by a victim is needed (UI:N), but the lack of integrity/availability impact and SSVC Automatable=no mean this cannot be scripted into a mass or wormable attack. Affected systems must be running builds below the fixed versions listed in EUVD (e.g., Windows 11 24H2 below 10.0.26100.9711, Windows Server 2022 below 10.0.20348.5761).

This is a genuinely moderate-priority local information-disclosure flaw, not a false high. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 5.5 MEDIUM) and the SSVC decision framework agree strongly: exploitation requires local access and existing low privileges (PR:L), there is no integrity or availability impact (I:N/A:N), and SSVC reports Exploitation=none, Automatable=no, Technical Impact=partial. These signals are mutually consistent - a locally-authorized attacker who can read beyond a buffer boundary in the EFS component to disclose memory contents (C:H), with no scope change (S:U). No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no POC referenced, so this is not an active-exploitation emergency. The main residual risk is that C:H combined with EFS (which handles cryptographic key material and file-encryption metadata) could leak sensitive in-memory secrets to an already-present local attacker, which elevates it above a trivial info leak in high-value or multi-user hosts. Overall: patch on normal cadence; it is not a drop-everything issue given local-only, authenticated, non-automatable characteristics.

A local user who already has a foothold on a Windows host (low-privileged account) invokes an EFS operation that triggers the out-of-bounds read, causing adjacent process memory to be returned and potentially exposing sensitive data such as encryption key fragments or other secrets. No public exploit code was identified at time of analysis, and exploitation is not automatable per SSVC, so this would be a manual, targeted action against a specific machine the attacker can already access.