Microsoft Digest Authentication CVE-2026-88158

Exploitation requires LOCAL access to an affected Windows system AND pre-existing low-level privileges (PR:L) - i.e., an authenticated local user or already-running low-privilege process; it is not remotely reachable (AV:L) and needs no user interaction (UI:N). The specific component is Microsoft Digest Authentication (SASL/Digest auth provider), so the vulnerable code path is reached by invoking or interacting with that authentication functionality. Limiting factors that reduce real-world risk: the attacker must already be present on the host with valid low privileges, the impact is confined to information disclosure (no code execution, modification, or DoS), and CISA SSVC assesses it as not automatable with no observed exploitation. Affected builds are bounded Windows versions below the patched build numbers listed in the EUVD data (e.g., Windows 11 24H2 below 10.0.26100.9711, Server 2025 below 10.0.26100.33650); fully patched systems are not exposed.

This is a genuinely low-to-moderate priority issue despite the 5.5 CVSS 'Medium' rating, and the signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) establishes that exploitation requires LOCAL access and existing LOW privileges on the target Windows host - this is not a remotely reachable flaw. The only impact is confidentiality (C:H, I:N, A:N): an out-of-bounds read (CWE-125) leaking memory contents, with no integrity or availability consequence. CISA's SSVC framework reinforces the low urgency: Exploitation=none (no observed or expected exploitation), Automatable=no (cannot be reliably scripted at scale, consistent with the local/authenticated requirement), and Technical Impact=partial. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified. There is no CISA KEV listing and no POC referenced, so this is 'no public exploit identified at time of analysis.' The one tension worth noting is scope: the product (Windows) is ubiquitous, which normally elevates urgency, but the local+authenticated+info-disclosure-only profile sharply limits real-world risk. Net: patch on a normal cadence; this is not an emergency. Treat it as a privilege-boundary memory-disclosure bug useful mainly as one link in a larger local attack chain rather than a standalone high-severity threat.

An attacker who already has a low-privileged local account (or has achieved low-privilege code execution via another vector) interacts with the Microsoft Digest Authentication component in a way that triggers an out-of-bounds read, causing adjacent process memory to be returned. The disclosed memory could contain sensitive material such as credential fragments or other secrets, which the attacker then uses to escalate further. No public exploit code was identified, and exploitation requires local access with existing privileges, making opportunistic mass exploitation impractical.