Windows Management Instrumentation CVE-2026-96851

Requires the attacker to already possess local, authenticated access to the Windows host with at least low-level privileges (PR:L) - there is no remote or unauthenticated path (AV:L). Exploitation targets the Windows Management Instrumentation (WMI) subsystem, which is present and enabled by default on all supported Windows editions, so no special non-default configuration is needed beyond the attacker being able to issue WMI operations. No user interaction is required (UI:N). The limiting factors are the mandatory local foothold and prior authentication; impact is restricted to information disclosure (C:H only, I:N/A:N), so it cannot by itself alter data or disrupt service.

This is a moderate-severity local information-disclosure flaw (CVSS 5.5) that, across all available signals, does NOT rise to urgent priority. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) requires local access and existing low-level privileges (PR:L), limiting exploitation to attackers who already have an authenticated foothold on the host; the impact is confined to confidentiality (C:H) with no integrity or availability effect. These signals align consistently with CISA's SSVC decision: Exploitation 'none' (no observed exploitation), Automatable 'no' (cannot be reliably scripted at scale because it needs local authenticated access), and Technical Impact 'partial'. It is not listed in CISA KEV, and no POC is indicated in the provided data, so this is NOT actively exploited. No EPSS score was supplied. There are no conflicting signals here - low-complexity local auth requirement plus confidentiality-only impact and 'none' exploitation status all point to a low real-world urgency item best handled through routine Patch Tuesday cycles rather than emergency response. The main caveat is that buffer over-reads can leak sensitive memory contents (e.g., addresses useful for defeating ASLR), so it may have value as a secondary step in a larger local privilege-escalation chain.

An attacker who already has low-privileged authenticated access to a Windows host (e.g., a standard user account or a compromised low-privilege service) invokes a crafted WMI operation that triggers a buffer over-read in the WMI component, causing adjacent process memory to be returned to the attacker. The leaked memory could expose sensitive data or memory-layout information useful for chaining into further privilege escalation. No public exploit is identified at time of analysis, and the attack cannot be performed remotely or without an existing local foothold.