Windows Push Notifications EUVD-2026-35731

Local authenticated access to the target Windows system is required (CVSS AV:L confirmed). A low-privileged user account (PR:L per CVSS) is sufficient - no administrative or elevated rights are needed. No user interaction from a victim is required (UI:N). The description does not indicate any non-default configuration, specific feature flag, or special deployment mode is required to expose the vulnerable code path, but exploitation impact is amplified on multi-user systems such as Windows Server in RDS or terminal server roles, where multiple users' in-memory data may be accessible. Exploitation is bounded by the local attack vector - remote or unauthenticated exploitation is not supported by the available data. Scope is unchanged (S:U), meaning privilege escalation beyond the attacker's current context is not a documented outcome.

The CVSS score of 5.5 (Medium) accurately reflects constrained real-world risk. The local attack vector (AV:L) is the dominant limiting factor - exploitation requires the attacker to already have an authenticated session on the target machine, ruling out all remote or network-based attack paths. The low-privilege requirement (PR:L) means any standard user account suffices, which is relevant in shared or multi-user environments such as terminal servers or VDI deployments. No CISA KEV listing is present and no POC is identified at time of analysis, meaning this is not a currently weaponized or mass-exploited issue. The high confidentiality impact (C:H) elevates concern in post-compromise scenarios - an attacker who has gained initial foothold via another vector could use this to harvest sensitive in-memory data. For most single-user endpoints, this represents a lower priority than network-exploitable vulnerabilities. For Windows Server environments hosting multiple concurrent user sessions (e.g., Server 2016/2019/2022/2025 in RDS or terminal server roles), the practical risk is meaningfully higher due to the multi-tenant attack surface.

An attacker with a standard domain or local user account on a shared Windows Server 2022 terminal server submits crafted interactions with the Windows Push Notifications service, triggering a code path that reads from an uninitialized memory region. The attacker iterates requests to recover fragments of sensitive data from memory - potentially including authentication tokens or sensitive application data belonging to other co-resident sessions. No public exploit code has been identified at time of analysis, meaning an attacker would need to independently develop a triggering mechanism.