Tanium Threat Response EUVD-2026-111249

Exploitation requires the attacker to already hold a low-privilege account with local access (AV:L, PR:L) on a host running the Tanium Threat Response Client Extension; there is no remote or network path and no user interaction is needed. The specific feature, input, or operation that triggers the out-of-bounds read is not described in the available sources. A significant limiting factor is the high attack complexity (AC:H): a condition outside the attacker's control must be met, so exploitation is not reliably repeatable, and the impact is confined to limited information disclosure (C:L) with minor availability effect (A:L) and no integrity impact. Affected products are the Tanium Threat Response CX and the Endpoint Configuration Toolset Solution; updating to the fixed versions from Tanium advisory TAN-2026-056 is the vendor remedy.

This is a genuinely low-priority issue, and the signals agree rather than conflict. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L, base 3.6 Low) describes a locally-exploitable flaw that needs an existing low-privilege foothold on the host and succeeds only under a high-complexity condition outside the attacker's direct control, yielding limited confidentiality and availability impact and no integrity impact. The vuln.today decision label is 'monitor', the lowest urgency tier, consistent with that score. No EPSS probability is supplied, there is no CISA KEV listing, and the references contain only the vendor advisory and the NVD page - no public exploit identified at time of analysis. CWE-125 (out-of-bounds read) matches an information-disclosure outcome. One inconsistency to flag for the reader: the input Tags include 'Buffer Overflow', which implies a memory-write/overflow, whereas the assigned CWE-125 and the vendor description both describe an out-of-bounds read / information disclosure - treat the 'Buffer Overflow' label as unverified. Overall this is a low-CVSS, low-real-risk issue: patch during normal maintenance, not an emergency.

An attacker who already has a low-privilege local account on a host running the Tanium Threat Response Client Extension triggers an out-of-bounds read in the extension and recovers small amounts of adjacent process memory that should not be exposed. Success depends on a high-complexity precondition the attacker does not fully control, so exploitation is unreliable. No public exploit code or PoC reference is present in the supplied sources.