Windows HID Parser CVE-2026-83904

Exploitation requires the attacker to already hold local, authenticated access to the Windows host (CVSS PR:L) and to cause the HID Parser Library to process a malformed or malicious HID report descriptor - for example by attaching or emulating a crafted USB/Bluetooth HID device or feeding attacker-controlled descriptor data to the parser. Limiting factors: there is no network attack surface (AV:L), the attacker must have prior low-privilege authentication, scope is unchanged (S:U) so impact is confined to the local system, and the outcome is read-only information disclosure (C:H/I:N/A:N) rather than code execution or system modification. No user interaction by a victim is required (UI:N). Applies to the enumerated unpatched Windows 10, 11, and Server 2019-2025 builds listed in the EUVD data.

This is a moderate-severity, low-priority issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a locally-exploitable flaw requiring existing low-level authentication, with only confidentiality impact and no integrity or availability effect. CISA's SSVC framework reinforces low urgency: Exploitation=none (no observed or public exploitation), Automatable=no, and Technical Impact=partial. No EPSS score was provided in the input, and the vulnerability is not listed in CISA KEV; combined with SSVC Exploitation=none, there is no evidence of active exploitation. The 'Buffer Overflow' tag is somewhat imprecise - CWE-125 and the description specify an out-of-bounds READ (information disclosure), not a memory-corrupting overflow write, which is consistent with the C:H/I:N/A:N impact profile. The one notable amplifier is that the affected product is Windows, which is ubiquitous; however, the local-access and prior-authentication requirements, plus the read-only nature of the disclosure, keep real-world risk low. All signals are internally consistent - no conflicts between the CVSS vector, CWE, and SSVC assessment.

An attacker who already has low-privilege authenticated access to a Windows system (for example, a standard local user or a foothold from another compromise) interacts with the HID Parser Library - typically by presenting or emulating a crafted Human Interface Device descriptor - to trigger an out-of-bounds read. The resulting memory disclosure could leak sensitive kernel or process memory useful for defeating ASLR or staging further privilege escalation. No public exploit was identified at time of analysis, and the CVSS local attack vector and prior authentication requirement make this a post-compromise or insider-style scenario rather than a remote entry point.