Windows WebDAV CVE-2026-96846

Exploitation requires the attacker to already have local, authenticated access to the Windows host (AV:L, PR:L) and to reach the vulnerable WebDAV code path (the WebClient/WebDAV redirector functionality). No user interaction is needed (UI:N) and complexity is low (AC:L), but the local + low-privilege prerequisite is the key limiting factor: remote, unauthenticated exploitation is not possible per the vector. Impact is confined to information disclosure (C:H, I:N, A:N) - the attacker reads memory but cannot modify data or cause a denial of service through this flaw alone. Realistic risk is therefore a post-compromise or malicious-insider escalation aid rather than an initial-access vector.

This is a moderate, not urgent, priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a local, low-complexity attack requiring low-level privileges (PR:L) that yields high confidentiality impact but no integrity or availability impact - consistent with an out-of-bounds read (CWE-125) that discloses memory contents. All exploitation signals point away from widespread risk: CISA's SSVC decision framework records Exploitation=none, Automatable=no, and Technical Impact=partial, meaning no observed exploitation and no path to automated/mass abuse. No EPSS score is provided in the input, and the CVE is not on CISA KEV, so there is no evidence of active exploitation; likewise no POC is referenced. The signals are internally consistent - a local, authenticated, info-disclosure bug with partial impact is a genuine but low-to-medium real-world concern, far from a 'high-CVSS-but-hollow' case because the CVSS itself is already modest. The main caveat is breadth of exposure: although per-host risk is limited by the local+authenticated requirement, the affected product is Windows (across essentially all supported client and server SKUs), so the aggregate patching footprint is very large even if individual exploitability is constrained.

A low-privileged but authenticated user already present on a Windows host invokes the WebDAV client/redirector code path with crafted input that triggers an out-of-bounds read, causing adjacent process or kernel memory to be returned to the attacker. Because the vector is local (AV:L) with low complexity (AC:L) and no user interaction, the attacker can repeatedly trigger the read to harvest sensitive in-memory data for privilege-escalation reconnaissance. No public exploit code is referenced, so exploitation would require the attacker to develop their own trigger.