Windows WLAN Service CVE-2026-83668

Exploitation requires the attacker to already hold local, authenticated access to the target host (CVSS PR:L, AV:L) - for example an interactive standard-user logon or malware running under an existing user token; it is NOT remotely or anonymously exploitable. The flaw resides in the Windows WLAN (wireless LAN) Service, so a host with the WLAN AutoConfig/WLAN service present and reachable by the local user is needed. No user interaction by a victim is required (UI:N), and the attack is low-complexity (AC:L), but the mandatory prior local authentication and the limitation to information disclosure (C:H, I:N, A:N - no code execution or system modification) are the primary factors limiting real-world risk.

This is a moderate-severity, low-priority issue despite the CVSS 5.5 (MEDIUM) rating, and the signals are mutually consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) describes a local-only vulnerability requiring an authenticated/authorized attacker who already has code-execution or logon access to the host; impact is confined to confidentiality (information disclosure) with no integrity or availability effect. CISA's SSVC decision framework reinforces low urgency: Exploitation 'none' (no observed exploitation), Automatable 'no' (cannot be reliably automated at scale, consistent with the local vector and auth requirement), and Technical Impact 'partial' (an out-of-bounds read leaks memory but does not grant full control). No EPSS score was supplied in the input, and there is no KEV listing and no public POC, so there is no evidence of widespread or targeted exploitation. The practical risk is bounded: an attacker must already be a local authenticated user, and the payoff is limited to memory disclosure (CWE-125), which could leak sensitive data but is typically useful only as one step in a larger chain. No key signals conflict here - the local vector, authenticated privilege requirement, and SSVC 'none/no/partial' all point to a genuine but low-priority defect best handled through routine Patch Tuesday deployment.

A local authenticated user (or malware running with a standard user token) on an affected Windows host interacts with the WLAN Service in a way that triggers the out-of-bounds read, causing the service to return adjacent process memory. The disclosed memory could contain sensitive data such as credentials, keys, or pointers useful for defeating ASLR in a subsequent exploit. No public exploit code has been identified, and the local vector plus PR:L requirement mean this is not remotely or anonymously exploitable.