Windows Shell CVE-2026-83905

Exploitation requires the attacker to already possess a valid low-privileged local account and an interactive/logon foothold on the target Windows host (AV:L, PR:L) - this is not remotely reachable. The high attack complexity (AC:H) indicates a non-trivial precondition such as a race condition or specific system state the attacker must win, limiting reliability. No user interaction is required (UI:N). The flaw affects the Windows Shell component across the listed Windows 10/11 and Windows Server 2012 R2-2025 builds below the patched revisions; impact is confined to disclosure of sensitive system information (C:H) with no integrity or availability effect, and scope is unchanged (S:U).

This is a low-to-moderate priority issue despite being a CRITICAL-confidentiality (C:H) information disclosure flaw. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, base 4.7, MEDIUM) shows multiple limiting factors: AV:L requires local access, AC:H requires a difficult-to-win condition (e.g., a race or specific state), and PR:L requires the attacker to already hold a valid low-privileged account on the host. These constraints materially reduce real-world exploitability. All exploitation signals are concordant and point to low risk: CISA SSVC reports Exploitation=none, Automatable=no, and Technical Impact=partial, there is no CISA KEV listing, and no public exploit code was identified in the provided data. EPSS score was not supplied, so probabilistic exploitation likelihood cannot be quantified. No signals conflict with one another. The high C:H rating reflects only the sensitivity of data that could be disclosed (CWE-497, exposure of sensitive system information), not ease of attack; it is not evidence of active or widespread exploitation.

An attacker who already has a low-privileged interactive or logon session on a Windows host exploits a difficult-to-trigger condition in Windows Shell to read sensitive system information that should be outside their authorization boundary. No public proof-of-concept exploit was identified, and the high attack complexity (AC:H) means the attacker must reliably win a specific timing or state condition. Success yields information disclosure only - no code execution, data modification, or denial of service.