Windows HID Parser CVE-2026-83884

Exploitation requires local access to an affected Windows system (AV:L) with at least low-privileged authenticated access (PR:L) - not remote or unauthenticated. The attacker must be able to reach the HID Parser Library with a malformed HID descriptor, which in practice means supplying a crafted Human Interface Device report or descriptor (e.g., via a physical, emulated, or virtual USB/Bluetooth HID device) or an equivalent user-mode interface that feeds the parser. No user interaction by a victim is needed (UI:N). Limiting factors: the attacker must already have a local foothold and valid credentials on the host, and the flaw yields only information disclosure (C:H, I:N, A:N) - it does not by itself grant code execution or privilege escalation, though leaked memory could aid further attacks. Affected builds span Windows 10 (1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2019/2022/2025; patched builds are available per the Microsoft advisory.

This is a moderate-severity, local information-disclosure flaw that signals come together to rank as a LOW real-world priority rather than an urgent one. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) requires local access and low privileges, delivers only confidentiality impact, and involves no integrity or availability loss - consistent with an out-of-bounds read (CWE-125) that leaks memory rather than enabling code execution. CISA's SSVC decision points reinforce this: Exploitation=none, Automatable=no, Technical Impact=partial, all pointing away from mass or automated exploitation. There is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided in the input (missing data - cannot quantify exploitation probability). The CVSS high confidentiality rating (C:H) is somewhat generous for a kernel-adjacent memory over-read, but it reflects potential disclosure of sensitive memory (e.g., for KASLR bypass or chaining). Net: a genuine but non-urgent patch-in-normal-cycle issue, not a drop-everything priority, given local-only access, required authentication, and absence of exploitation signals.

A low-privileged user who already has local access to a Windows host supplies or interacts with a malicious HID (Human Interface Device) descriptor - for example via a crafted or emulated USB/Bluetooth device or a user-mode path that reaches the HID Parser Library - triggering an out-of-bounds read. The over-read leaks adjacent memory contents back to the attacker, potentially exposing sensitive data or defeating memory-layout mitigations. No public proof-of-concept is known, and the low attack complexity (AC:L) means the trigger itself is reliable once local access is obtained.