Windows HID Parser CVE-2026-83887

Requires the attacker to already have authenticated local access to the Windows host (PR:L, AV:L) and the ability to drive the HID Parser Library with attacker-controlled HID input - typically a malicious or emulated USB HID device or a crafted HID report descriptor processed by the OS. There is no remote network vector and no user-interaction requirement for a second victim (UI:N). Limiting factors: exploitation yields only information disclosure (C:H, I:N, A:N) with no code execution, affects only the exploited process scope (S:U), is rated non-automatable by CISA SSVC, and applies to Windows builds below the patched versions listed in EUVD-2026-100024 (e.g. Windows 11 24H2 below 10.0.26100.9711, Windows Server 2022 below 10.0.20348.5761).

This is a genuine but comparatively low-urgency issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a local, low-complexity, authenticated information-disclosure flaw with high confidentiality impact but no integrity or availability effect - consistent with an out-of-bounds read (CWE-125) leaking memory contents. All exploitation signals point the same direction and reinforce low real-world priority: there is no CISA KEV listing, no public proof-of-concept, and the CISA SSVC decision framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as 'partial'. EPSS is not provided in the input, so probabilistic exploitation likelihood cannot be quantified here. No signals conflict: the local attack vector (AV:L) and the 'Automatable: no' SSVC value are mutually consistent, and the 'partial' technical impact aligns with an info-leak rather than code execution. Net assessment: a legitimate medium-severity local disclosure bug worth patching in routine cycles, not an emergency - the requirement for prior local, authenticated access substantially limits attacker reach.

An attacker who already has a low-privileged local foothold on a Windows host (for example a logged-in standard user or a process running as that user) interacts with the HID Parser Library - plausibly by connecting or emulating a malicious USB HID device, or supplying a crafted HID report descriptor - to trigger an out-of-bounds read that leaks adjacent memory contents, potentially revealing sensitive data useful for further privilege escalation. No public exploit identified at time of analysis, and the low CVSS reflects the local vector and need for prior authenticated access.