Windows AppID Subsystem EUVD-2026-35552

Exploitation requires an authenticated local session with at minimum standard (low-privileged) user rights, as confirmed by the CVSS vector (AV:L/PR:L). The attacker must be able to execute code locally on the target system - remote-only access is not sufficient. No specific non-default configuration is required; the AppID service runs by default on all affected Windows versions. Limiting factors include: the requirement for local code execution (eliminates remote-only threat actors), the low-privilege requirement still meaning an initial access vector must be established first, and the impact being limited to confidentiality with no code execution or persistence capability from this CVE alone. This vulnerability does not enable standalone remote exploitation against default configurations - an attacker must already have a local session.

The CVSS base score of 5.5 (Medium) accurately reflects a bounded risk profile: the attack vector is local (AV:L), complexity is low (AC:L), requires low privileges (PR:L), and scope is unchanged (S:U), with high confidentiality impact (C:H) but no integrity or availability impact (I:N/A:N). This means an attacker who already has a foothold as a standard user could escalate their information access significantly - a meaningful concern in shared Windows environments (RDS servers, VDI, multi-user workstations) where privilege boundaries between users matter. No EPSS data was provided, and no CISA KEV listing or public POC was identified, suggesting this has not been broadly or actively exploited. The real-world priority is elevated in environments where lateral movement or sensitive credential/token exposure via AppID is a concern, but it is not an emergency patch for isolated single-user endpoints. The absence of EPSS data is a gap; risk should be contextualized against whether AppLocker or AppID-dependent controls are deployed in the environment.

An attacker who has obtained a low-privileged local account on a Windows system - through phishing, credential theft, or an existing foothold - interacts with the AppID subsystem via a crafted local API call or IPC request to read sensitive information beyond their privilege level, such as tokens, policy data, or identity metadata belonging to other processes or users. No public POC exists at time of analysis, but the low attack complexity (AC:L) means that once the specific triggering mechanism is understood, exploitation would be straightforward for an attacker already on the system. In RDS or multi-tenant server environments, this could allow a low-privileged user to read sensitive data associated with other sessions or administrative processes.