Windows Hello EUVD-2026-100044

Exploitation requires the attacker to already have authenticated local access with at least low-level privileges (PR:L) on a system running an affected Windows 10 or Windows 11 build with Windows Hello present, and to interact locally with the Windows Hello component (AV:L); no user interaction from a victim is needed (UI:N). Limiting factors that reduce real-world risk: the flaw is not remotely reachable, cannot be triggered without an existing local privileged foothold, is rated not automatable by SSVC, and yields only information disclosure (no code execution, modification, or denial of service). Patched builds are available from Microsoft (fixed at 10.0.19044.7807 / 19045.7807 for Win10, and the 9711/7652/3231 build floors for the respective Win11 versions), so patched systems are not exposed.

This is a genuine but comparatively low-priority issue rather than an urgent one. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a local, low-complexity attack that requires the attacker to already hold low-level privileges (PR:L) on the machine; impact is confined to confidentiality (C:H) with no integrity or availability effect. These raw metrics align well with the SSVC decision framework, which reports Exploitation: none, Automatable: no, and Technical Impact: partial - all three point to a flaw that is neither remotely reachable nor scalable. There is no CISA KEV listing and no public exploit identified at time of analysis, so exploitation status is 'no public exploit identified at time of analysis.' EPSS is not provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The signals are internally consistent (local + privilege-required + not automatable + no known exploitation all reinforce 'bounded, hands-on-keyboard risk'), so there is no conflict to flag; the main caveat is simply that an EPSS score is absent. Overall: a real local information-disclosure defect worth patching in routine cycles, not an emergency.

An attacker who already has a low-privileged local account or foothold on a Windows endpoint invokes the vulnerable Windows Hello component and reads sensitive system information that should have been restricted to a higher privilege sphere. Because the vector is local and requires existing privileges with no user interaction, this is most plausible as a post-compromise privilege/information-gathering step rather than an initial intrusion. No public proof-of-concept is identified in the provided data.