Windows Servicing Stack CVE-2026-85835

Exploitation requires LOCAL access to an affected Windows or Windows Server host AND pre-existing low-level privileges (PR:L) - the attacker must already be able to execute code or interact with the Servicing Stack Update component as at least a standard/low-privileged principal. It targets the Windows Servicing Stack, the subsystem responsible for installing updates, on affected builds (Windows 11 24H2 <10.0.26100.9711, 25H2 <10.0.26200.9711, 26H1 <10.0.28000.3231, 26H2 <10.0.26300.9711, and Windows Server 2025 <10.0.26100.33650). Limiting factors: no remote/network vector, no unauthenticated path, and no user interaction of a victim is leveraged; the attacker themselves must be present and authenticated locally. Impact is confined to information disclosure (memory over-read) with no integrity or availability effect, which bounds realistic damage to leakage of in-memory data.

This is a genuinely low-priority issue despite a 'Medium' 5.5 CVSS score. All signals align toward low real-world risk: the CVSS vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, meaning exploitation requires local access and existing low-level privileges on the host, with no network vector. The only impact is confidentiality (C:H) from a buffer over-read (CWE-126) that discloses memory contents; there is no integrity or availability impact. CISA's SSVC decision framework reinforces this: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be mass-exploited at scale), and Technical Impact=partial. There is no CISA KEV listing and no public POC identified. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. The signals are internally consistent - nothing conflicts - and all point to a local, privilege-dependent information-disclosure bug that is a patch-in-normal-cycle item rather than an emergency. The one nuance for defenders: because it affects the Servicing Stack (the component that installs Windows updates), it is present across the entire Windows ecosystem, so patch breadth is wide even though per-instance risk is modest.

A local attacker who already has a low-privileged foothold on a Windows host (e.g., a standard user account or a constrained service) triggers the buffer over-read in the Servicing Stack Update component to read adjacent process memory, potentially leaking sensitive data such as credentials, tokens, or other secrets residing in memory. Because AV:L/PR:L applies, this is not a remote or unauthenticated attack and is more plausibly a secondary step in a local privilege-escalation or post-compromise chain. No public exploit code has been identified at time of analysis.