Windows KSP EUVD-2026-100335

Exploitation requires the attacker to already have local, authenticated access to the target Windows system (AV:L, PR:L) - this is not remotely reachable and not exploitable by an anonymous user. The attacker must interact with the Windows Key Storage Provider (KSP), the CNG component that brokers access to stored cryptographic keys. Exploitation is further limited by high attack complexity (AC:H), indicating a required condition outside the attacker's direct control - typically a race condition or a specific memory state that must be met for the out-of-bounds read to disclose useful adjacent memory rather than fail. There is no user-interaction requirement (UI:N), and impact is confined to confidentiality (information disclosure); the flaw cannot modify data or cause denial of service. All supported Windows releases from Server 2012 R2 through Server 2025 and Windows 10/11 are affected until patched to the fixed build in the EUVD version ranges.

This is a genuinely low-to-moderate priority issue despite the CWE-125 memory-safety class. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) scores 4.7 (Medium) and tells a consistent story: exploitation requires local access (AV:L), existing low-level authentication/authorization (PR:L), AND high attack complexity (AC:H) - meaning the attacker must win a race or satisfy conditions outside their control. The only impact is confidentiality (C:H, I:N, A:N) - an information disclosure with no integrity or availability consequence. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no POC/exploit code is referenced, so there is no public exploit identified at time of analysis. The sole source is Microsoft's own MSRC advisory (reported by secure@microsoft.com), i.e. internally discovered rather than found through observed attacks. The combination of local-only vector, required privileges, high complexity, and confidentiality-only impact makes this a defense-in-depth patch item, not an emergency. No signals conflict; the limiting factor is simply that a high-CVSS memory-safety CWE does not translate to high real-world risk here because every exploitability metric is unfavorable to the attacker.

A low-privileged local user already logged into a Windows host triggers an out-of-bounds read in the Key Storage Provider (KSP), causing it to return adjacent process/kernel memory and disclosing sensitive material such as cryptographic key fragments or other in-memory secrets. Because the CVSS vector specifies high attack complexity (AC:L is NOT set), the attacker likely must win a timing/race condition or satisfy specific memory-layout preconditions, so success is not guaranteed on each attempt. No public exploit code is identified at time of analysis.