Microsoft Windows CVE-2026-96321

Exploitation requires the attacker to already possess an authenticated, low-privileged local foothold on the Windows host (AV:L, PR:L) and the ability to execute code that reaches the Remote Desktop Display Driver component; no user interaction is needed (UI:N). Limiting factors: there is NO remote or unauthenticated path, the attacker must run on the affected system, impact is confined to information disclosure (C:H, I:N, A:N) with no code execution or system compromise by itself, and SSVC rates it non-automatable. The affected products are specific patched Windows 10/11 and Windows Server 2022/2025 builds below the fixed versions listed in EUVD-2026-100226.

This is a moderate-severity information-disclosure flaw whose signals are internally consistent and point to LOW real-world urgency despite the HIGH confidentiality impact. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) requires LOCAL access and LOW privileges (PR:L = an authenticated, non-privileged user), with no integrity or availability impact. CISA's SSVC framework reinforces de-prioritization: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be reliably scripted for mass exploitation), and Technical Impact=partial. No EPSS score was provided in the input, and the CVE is NOT on the CISA KEV list and has no public POC, so there is no public exploit identified at time of analysis. The consistent picture is a genuine but low-priority local info-leak primitive, most valuable as a chained building block (e.g., defeating ASLR or leaking memory contents to aid a separate privilege-escalation exploit) rather than a standalone priority. One minor data caveat: the input Tags include 'Buffer Overflow', but the CWE (CWE-125) and description describe an out-of-bounds READ (a buffer over-read / information disclosure), not a classic writable buffer overflow, so treat the 'Buffer Overflow' tag as imprecise.

An attacker who already has a low-privileged authenticated session on a Windows host (for example via an existing RDP logon or local account) runs crafted code that interacts with the Remote Desktop Display Driver to trigger an out-of-bounds read. The driver returns adjacent kernel or process memory, leaking sensitive data such as pointers or secrets that can weaken memory protections. No public exploit code or active exploitation is identified at time of analysis, and local access with low privileges is required.