Windows MTP Driver EUVD-2026-100004

Requires local, authenticated access to the Windows host (PR:L) and interaction with the Windows Portable Device MTP (Media Transfer Protocol) driver - typically achieved by connecting or emulating a portable device (phone, camera, media player) and issuing crafted MTP protocol requests that the driver mishandles, causing an out-of-bounds read. No user interaction by a victim is required (UI:N). Limiting factors that reduce real-world risk: the attacker must already have a local account/code-execution foothold on the machine (no remote vector, AV:L), impact is confined to information disclosure (C:H, I:N, A:N), and CISA SSVC reports no known or expected exploitation. The flaw affects a broad range of Windows client and Server builds (Windows 10/11, Server 2012 through 2025) per the EUVD version list, patched in the vendor-specified builds.

This is a medium-severity local information-disclosure flaw (CVSS 5.5) that should be treated as routine patch-cycle priority rather than an emergency. The CVSS vector (AV:L/AC:L/PR:L/UI:N/C:H/I:N/A:N) confirms exploitation requires local access and existing low-level authorization, with impact limited to confidentiality - no integrity or availability loss. CISA's SSVC framework reinforces low urgency: Exploitation=none (no observed or expected exploitation), Automatable=no, and Technical Impact=partial. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is no public exploit identified at time of analysis. EPSS data was NOT provided in the input, so probability-of-exploitation cannot be quantified here - however, the SSVC 'Exploitation: none' signal and the local/authenticated requirement both argue against widespread opportunistic abuse. The signals are internally consistent (medium CVSS, no exploitation evidence, confidentiality-only impact), with no contradictions to flag. Net: a genuine but low-to-moderate-priority issue - most valuable to an attacker as a secondary step (e.g., leaking memory to defeat ASLR) rather than a standalone threat.

An attacker who already has a low-privileged local foothold on a Windows host interacts with the Portable Device / MTP driver - for example by presenting a connected or emulated portable device and issuing crafted MTP commands - to trigger an out-of-bounds read. The leaked driver/kernel memory could reveal sensitive data or address-layout information useful for chaining into a privilege-escalation exploit. No public proof-of-concept exploit was identified in the provided data.