Windows Cryptographic Services EUVD-2026-100161

Exploitation requires the attacker to already have local, authenticated access to the Windows host with at least low-level user privileges (PR:L, AV:L) and to be able to invoke the vulnerable Windows Cryptographic Services code path; there is no remote or unauthenticated path and no user-interaction lure involved. Limiting factors that reduce real-world risk: the attacker must first gain a foothold on the machine, impact is confined to information disclosure (no code execution, tampering, or denial of service), and only Windows builds below the patched versions are affected - Windows Server 2025 <10.0.26100.33650, Windows 11 24H2/25H2 <10.0.26x00.9711, 26H1 <10.0.28000.3231, 26H2 <10.0.26300.9711. Patched systems are not exploitable.

This is a moderate-severity local information disclosure flaw (CVSS 5.5) and the available signals consistently point to LOW real-world urgency rather than an emergency. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms the attacker must already have local access and valid (low) privileges on the host; the only impact is confidentiality (C:H), with no integrity or availability effect. CISA's SSVC decision framework reinforces this: Exploitation='none' (no observed or public exploitation), Automatable='no' (cannot be reliably mass-exploited), and Technical Impact='partial'. There is no CISA KEV listing, no POC referenced, and no EPSS score was supplied in the input, so exploitation probability cannot be quantified from this data - however the SSVC 'none'/'no' combination strongly implies it is not currently weaponized. No signals conflict here: a local-only, authenticated, info-disclosure-only bug with no exploitation evidence is a genuine patch-in-normal-cycle item, not a drop-everything priority. The only mild tension is the 'Buffer Overflow' tag versus the underlying CWE-125 (out-of-bounds READ), which describes a memory over-read, not a classic write overflow - the read-only nature is consistent with the confidentiality-only impact.

A low-privileged user already logged onto a Windows host (or malware running under such an account) invokes Windows Cryptographic Services in a way that triggers an out-of-bounds read, causing adjacent process/heap memory to be returned. The disclosed bytes could include cryptographic material or other sensitive data useful for further local privilege escalation or lateral movement. No public exploit code is referenced, and exploitation requires pre-existing local access, so this is a post-compromise information-gathering step rather than an initial-access vector.