Windows RNDIS CVE-2026-83788

Exploitation requires physical access to the target system and the ability to present a malicious RNDIS (Remote NDIS over USB) device or control traffic to the Windows RNDIS driver; the driver's parsing of attacker-supplied RNDIS data is what triggers the over-read. Although the CVSS vector is PR:N/UI:N (no authentication or user interaction once physical access is obtained), the AV:P physical-access requirement is the dominant limiting factor - remote or network-based exploitation is not possible. Impact is limited to information disclosure of adjacent memory (C:H/I:N/A:N); there is no code execution, integrity, or availability impact. Risk is realistically confined to environments where untrusted parties can physically connect devices (kiosks, shared/unattended machines, evil-maid scenarios).

This is a genuinely low-priority issue despite a HIGH confidentiality impact rating in the CVSS vector. The CVSS 3.1 vector (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 4.6 Medium) hinges entirely on AV:P (Physical) attack vector, which caps the score and demands the attacker be physically present at the device - a severe real-world constraint that no amount of C:H rating offsets. All exploitation signals align and reinforce low risk: CISA SSVC reports Exploitation 'none', Automatable 'no', and Technical Impact 'partial', which is consistent with an information-disclosure-only flaw (C:H/I:N/A:N). No KEV listing and no public POC were provided, and no EPSS score was supplied in the input (EPSS absence is noted, not treated as zero). There are no conflicting signals here - the physical vector, the partial/non-automatable SSVC judgment, and the information-only impact all point the same direction. The one nuance worth stating: C:H in the vector is somewhat generous for a buffer over-read, which typically leaks adjacent memory fragments rather than guaranteeing high-value secrets; defenders should weight this as a memory-disclosure primitive, not a wholesale data breach. A patch is available from Microsoft, so remediation is straightforward via normal Windows Update cadence rather than emergency action.

An attacker with physical access to a Windows machine connects or emulates a malicious USB device that presents an RNDIS (Remote NDIS networking) interface and sends a crafted descriptor or control message that the RNDIS driver parses, triggering a buffer over-read that returns adjacent kernel/driver memory contents to the attacker. No public exploit code was identified at time of analysis, and the SSVC framework rates this as non-automatable with only partial technical impact, so realistic exploitation is limited to targeted, hands-on scenarios (e.g., evil-maid or unattended-device attacks).