Windows RAS CVE-2026-87698

Exploitation requires the attacker to already have a valid low-privilege authenticated session on the target Windows system (PR:L) and local access to it (AV:L) - there is no network-facing or unauthenticated path. The attacker must be able to interact with the Windows Remote Access Service Infrastructure component to supply input that triggers the out-of-bounds read. Limiting factors: the local-only vector means remote exploitation is not possible, exploitation cannot be automated at scale (SSVC Automatable: no), and impact is confined to information disclosure (C:H, I:N, A:N) rather than code execution or system compromise. The affected versions span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025; hosts patched to the fixed builds listed in the EUVD data are not exposed.

This is a moderate-severity information disclosure vulnerability that is NOT a top-tier emergency priority despite affecting a ubiquitous platform. The CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates a local attack vector requiring low privileges and low attack complexity, with high confidentiality impact but no integrity or availability impact - consistent with an out-of-bounds read (CWE-125) that leaks memory rather than enabling code execution. All signals align toward LOW real-world urgency: CISA's SSVC decision framework rates Exploitation as 'none' (no observed or public exploitation), Automatable as 'no' (cannot be reliably scripted at scale, consistent with the local-only vector), and Technical Impact as 'partial.' There is no CISA KEV listing and no EPSS score was provided in the input, so exploitation-probability cannot be quantified here. There is no public exploit identified at time of analysis. The signals are internally consistent - there is no conflict between the local vector, the SSVC 'none/no/partial' rating, and the absence of KEV/POC data - so this reads as a genuine low-to-moderate priority: a patch-in-normal-cycle issue rather than an out-of-band emergency. The main residual risk is as a post-compromise primitive (e.g., leaking memory to defeat ASLR or harvest secrets) for an attacker who already has an authenticated local foothold.

An attacker who already holds a low-privileged authenticated account on a Windows host (for example via phishing, stolen credentials, or an earlier foothold) locally invokes the Remote Access Service Infrastructure component with crafted input that triggers an out-of-bounds read, causing adjacent process memory to be returned to the attacker. The disclosed memory could contain sensitive data such as credentials, cryptographic material, or address-layout information useful for chaining into a further exploit. No public exploit code has been identified at time of analysis, and the local vector plus low-privilege requirement limit this to attackers with existing access.