EUVD-2026-100026
GHSA-gm5h-qx42-jh4x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain authenticated local access
-
ExploitSupply crafted HID descriptor
-
ExecutionTrigger out-of-bounds read in HID Parser Library
-
ImpactDisclose adjacent memory contents
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already hold authenticated, low-privileged local access to the Windows host (PR:L, AV:L) and to cause the HID Parser Library to process an attacker-influenced or malformed HID report/descriptor. There is no remote vector and no user interaction by a victim is needed (UI:N), but the need for a pre-existing local authenticated session is the primary limiting factor, confining risk to post-compromise or malicious-insider scenarios rather than remote mass exploitation. Impact is limited to information disclosure (C:H) with no write/integrity or availability effect. |
| Impact | This is a moderate-severity, low-priority issue in practice. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a local, low-complexity attack requiring an already-authenticated low-privileged user, yielding only a confidentiality impact (information disclosure) with no integrity or availability effect - consistent with an out-of-bounds read (CWE-125). The CISA SSVC decision framework reinforces the low urgency: Exploitation=none, Automatable=no, Technical Impact=partial, which maps to a 'Track' rather than 'Act' disposition. No EPSS score was supplied in the input, and the CVE is not listed in CISA KEV, with no public exploit identified at time of analysis. All signals are mutually consistent - local-only vector, authenticated prerequisite, partial impact, and no observed exploitation - so there is no conflict to flag; this is a genuine but not urgent patch-in-normal-cycle item rather than an emergency. The main caveat is that EPSS data is absent, so exploitation probability could not be independently weighed. |
| Exploit ScenarioDerived | A low-privileged but authenticated local user on a Windows system interacts with a crafted or malformed HID (Human Interface Device) descriptor that the HID Parser Library processes, triggering an out-of-bounds read. The attacker uses the over-read to disclose adjacent memory contents, potentially leaking sensitive kernel or process data. No public exploit code is identified, and the local vector plus authentication requirement limit this to attackers who already have a foothold on the machine. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
An out-of-bounds read in the Windows HID Parser Library lets an authenticated, low-privileged local attacker disclose information from the host by inducing the parser to process a malformed or attacker-influenced HID report or descriptor, yielding a CVSS v3.1 score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only confidentiality is affected - there is no integrity or availability impact - and because the vector requires PR:L and AV:L, an attacker must already hold a local authenticated session, making this a post-compromise or malicious-insider concern rather than a remotely reachable one. Vendor patches are available and no public exploit has been identified at time of analysis, and CISA's SSVC assessment records exploitation as none and automatable as no, reinforcing a moderate-severity, low-priority rating in practice.
RemediationAI
Vendor-released patch: Microsoft has published fixes in the Security Update Guide for CVE-2026-83898 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83898); apply the current cumulative update so affected hosts reach the fixed builds - for example Windows 11 23H2 at 10.0.22631.7652 or later, Windows 11 24H2 and Windows Server 2025 at 10.0.26100.9711 and 10.0.26100.33650 respectively, Windows 11 25H2 at 10.0.26200.9711, Windows 11 26H1 at 10.0.28000.3231, Windows 11 26H2 at 10.0.26300.9711, Windows Server 2019 at 10.0.17763.9376, Windows Server 2022 at 10.0.20348.5761, and Windows 10 21H2/22H2 at 10.0.19044.7807. Because exploitation requires an existing authenticated local session (PR:L, AV:L) and yields only information disclosure, patching should be prioritized by the value of the data reachable on the host rather than by remote exposure; until updates are deployed, compensating controls are limited to reducing the number of local accounts and unprivileged interactive sessions that can trigger HID descriptor parsing, removing untrusted or unneeded HID peripherals and virtual HID drivers (which may break input devices for legitimate users), and tightening local logon and RDP access so that low-privileged code execution on the host is harder to obtain in the first place. Standard hardening such as Credential Guard/VM-based security and restricting local debugging rights reduces the value of the leaked memory but does not eliminate the read primitive, and since SSVC records Exploitation as none and Automatable as no with no public exploit identified at time of analysis, emergency out-of-band handling is not warranted.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 13 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic out-of-bounds read (CWE-125) in the Windows HID (Human Interface Device) Parser Library, the kernel/user-mode component that decodes HID report descriptors and report data for peripherals such as keyboards, mice, game controllers, and vendor-specific HID devices. The parser consumes length and index fields supplied by the device or by a caller, and when those values are not validated against the actual buffer size, the parser can read past the end of an allocated buffer, returning adjacent memory contents to the caller. Microsoft assigned the issue to its secure@microsoft.com reporting channel and classifies the impact as an information-disclosure bug; the accompanying tags (Buffer Overflow, Information Disclosure) are consistent with a bounds-checking failure rather than memory corruption, since no write primitive or availability effect is described. EUVD tracks the flaw as EUVD-2026-100026 and enumerates affected Windows builds through 10.0.x servicing ranges, confirming that the shared HID parsing stack in Windows 10, Windows 11, and the Windows Server 2019/2022/2025 code base is the exposure surface rather than a single third-party driver.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Out-of-bounds read reachable only by an authenticated local user (AV:L, PR:L), low complexity, pure information disclosure so C:H with I:N/A:N.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Exploit-DB