Windows AppID Subsystem EUVD-2026-35553

Exploitation requires an attacker to already have a local, interactive or programmatic session on the target system under at minimum a low-privileged (non-guest) Windows account - confirmed by CVSS PR:L. No network access is required; this is a purely local vulnerability (AV:L). No user interaction beyond the attacker's own actions is needed (UI:N). The vulnerability is in the AppID subsystem, which is active by default on Windows systems where AppLocker policies are evaluated; no non-default configuration is implied to be required for the vulnerable code path to be reachable. Exploitation is limited by the requirement for local access - remote unauthenticated exploitation is not possible per the CVSS vector.

The CVSS score of 5.5 (Medium) reflects a local-only, authenticated attack path with no integrity or availability impact - a constrained threat profile. CVSS vector AV:L/AC:L/PR:L/UI:N confirms exploitation requires local machine access with at minimum a low-privileged account, limiting the attacker pool to insiders, malware already present on the host, or users who have achieved initial foothold via a separate vector. The C:H rating is the primary concern: a successful out-of-bounds read in a security-relevant subsystem like AppID could leak policy enforcement data, authentication tokens, or memory addresses useful for bypassing ASLR in a chained attack. No EPSS score was provided in the input data; no KEV listing is present; no public proof-of-concept has been identified. This combination places the vulnerability at moderate-priority: important to patch on sensitive systems (domain controllers, admin workstations, servers running AppLocker) but not an emergency for air-gapped or heavily access-controlled environments. The tag 'Buffer Overflow' in the source data is potentially misleading - the root cause is CWE-125 (read overrun), not a write-based buffer overflow; treat that tag as an artifact of source tagging rather than an indication of code execution potential.

A low-privileged local user or a process running under a standard account (e.g., malware that has achieved user-level code execution via a separate initial access vector) calls into the Windows AppID subsystem with a malformed or boundary-case request. The out-of-bounds read triggers, returning memory contents from an adjacent region to the attacker's process, potentially including sensitive data such as kernel pointers or cached credentials. No public proof-of-concept exists at time of analysis, but the low attack complexity (AC:L) indicates exploitation would be straightforward once the triggering API call or input condition is identified.