Aggregated Data Platform EUVD-2026-100027

Exploitation requires an attacker who already holds a local, authenticated low-privileged account on an affected Windows 11 host (AV:L, PR:L) - there is no remote or unauthenticated path. The target must be a vulnerable build below the patched versions: Windows 11 26H1 (<10.0.28000.3231), 26H2 (<10.0.26300.9711), 25H2 (<10.0.26200.9711), or 24H2 (<10.0.26100.9711), with the Aggregated Data Platform Service present and reachable by the local user. No user interaction is required (UI:N), but the mandatory local access and pre-existing privileges are the key limiting factors that sharply constrain realistic risk; impact is confined to confidentiality (information disclosure) with no integrity or availability effect.

This is a moderate-severity local information disclosure issue that does NOT warrant emergency prioritization. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) tells a consistent story: exploitation requires local access and existing low-level privileges (PR:L), carries no integrity or availability impact, and only yields high confidentiality impact (memory disclosure via out-of-bounds read, CWE-125). All signals align and reinforce low urgency: CISA SSVC rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'. There is no CISA KEV listing and no public exploit identified, so there is no public exploit identified at time of analysis. No EPSS score was supplied in the input, so quantitative exploitation probability cannot be stated. In short, this is a high-CVSS-relative-to-impact but genuinely low-real-world-risk issue: an already-authenticated local user could leak sensitive process memory, but there is no remote vector, no privilege escalation, and no automation potential. Prioritize via normal Patch Tuesday cadence rather than out-of-band response.

An attacker who already has a low-privileged authenticated session on a Windows 11 host runs a crafted local program or input that interacts with the Aggregated Data Platform Service, triggering an out-of-bounds read that returns adjacent process memory. The disclosed memory could contain secrets useful for a follow-on privilege-escalation chain. No public exploit code is known, and because the CVSS vector is AV:L/PR:L, remote or unauthenticated exploitation is not possible.