Windows StateRepository EUVD-2026-100049

Exploitation requires the attacker to already hold a valid, authenticated low-privileged account (PR:L) with the ability to execute code locally (AV:L) on an affected Windows host, and to invoke the StateRepository API with input that triggers the over-read. There is no user-interaction requirement (UI:N) and no special non-default configuration is called out in the description - the affected StateRepository component is a standard part of Windows 11 (24H2/25H2/26H1/26H2) and Windows Server 2025. The primary limiting factors are the local attack vector and the pre-existing authentication/privilege requirement: a remote or unauthenticated attacker cannot reach this flaw directly. Affected builds are below the patched revisions (e.g. Windows 11 24H2 before 10.0.26100.9711; Server 2025 before 10.0.26100.33650).

This is a genuinely low-to-moderate priority issue despite its CRITICAL-sounding confidentiality impact. All signals align toward low real-world risk: the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5 MEDIUM) requires LOCAL access and PRE-EXISTING privileges (PR:L), meaning the attacker must already be authenticated on the host. CISA's SSVC framework corroborates this: Exploitation=none (no observed or expected exploitation), Automatable=no (cannot be reliably scripted at scale), and Technical Impact=partial. There is no CISA KEV listing and no public proof-of-concept identified in the provided data, and no EPSS score was supplied. The only elevated metric is C:H (high confidentiality impact), which drives the 5.5 score, but that impact is gated behind local authenticated access and yields information disclosure only (I:N/A:N - no integrity or availability impact). Net: this is a high-confidentiality-label but low-real-risk issue, best treated as part of routine patch cycles rather than emergency remediation. No conflicting signals were observed; the CVSS local vector is consistent with the description's explicit 'locally' and 'authorized attacker' language.

An attacker who already has a valid, low-privileged local account on a Windows host runs a crafted local process that invokes the StateRepository API in a way that triggers a buffer over-read, causing adjacent memory to be returned. The disclosed bytes may contain sensitive data from other processes or system structures, aiding further privilege escalation or reconnaissance. No public exploit code was identified, and exploitation requires prior local access and authentication, substantially limiting opportunistic abuse.