Windows MDM EUVD-2026-100229

Exploitation requires the attacker to already have an authenticated low-privileged local foothold on the Windows host (PR:L, AV:L) and to interact with the Modern Device Management (MDM) subsystem, which reads an uninitialized resource and returns residual memory contents (CWE-170). No user interaction is required (UI:N) and complexity is low (AC:L). Limiting factors: no remote vector, so network-only attackers cannot exploit it; the attacker needs valid local access and the ability to execute code that reaches the MDM code path; impact is confined to disclosure (C:H, I:N, A:N) with no scope change (S:U). All listed Windows 10/11 and Windows Server builds below the fixed revisions are affected until patched.

This is a genuine-but-moderate priority, not an urgent one. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a local, low-complexity attack requiring low privileges and no user interaction, yielding high confidentiality impact but zero integrity or availability impact - i.e. pure information disclosure of uninitialized memory. All exploitation signals point the same direction and reinforce a lower real-world risk: SSVC shows Exploitation=none, Automatable=no, and Technical Impact=partial, there is no CISA KEV listing, and no public exploit code has been identified. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The local attack vector (AV:L) plus required low privileges (PR:L) means an attacker must already have authenticated code-execution footing on the host, which substantially limits attractiveness and blast radius; this is typically a privilege-escalation building block or memory-disclosure aid rather than a standalone remote threat. The signals are internally consistent - there is no CVSS-versus-description conflict to flag - and the main limitation is the absence of an EPSS value to triangulate exploitation probability.

An attacker who already has a low-privileged authenticated session on a Windows host runs a crafted local process that invokes the Modern Device Management (MDM) component in a way that returns uninitialized memory. The leaked bytes may contain sensitive data (credentials, tokens, pointers) useful for further escalation. No public exploit code has been identified, and exploitation requires local access with low complexity (AV:L/AC:L).