Windows Push Notifications EUVD-2026-35732

Requires an existing local session on the target system with at minimum a low-privileged (standard user) account, as confirmed by PR:L in the CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U vector. The Windows Push Notifications service (WpnService) must be running, which is the default state on all modern Windows desktop and server installations; no non-default configuration is required. No user interaction is required from another user or administrator (UI:N), making exploitation fully autonomous once local access is established. Exploitation is strictly limited to local access (AV:L) - remote unauthenticated exploitation is not possible per the CVSS vector. The scope is unchanged (S:U), meaning the attacker cannot pivot beyond the notification service's own privilege boundary through this vulnerability alone. The primary limiting factor is the requirement for prior local authenticated access, making this exclusively relevant as a post-compromise information disclosure primitive rather than an initial access vector.

The CVSS 5.5 Medium score is anchored by AV:L (local attack vector), PR:L (low-privileged authentication required), UI:N (no user interaction), S:U (unchanged scope), and C:H/I:N/A:N - meaning confidentiality impact is high but exploitation is strictly local. This combination limits real-world risk substantially: an attacker must already have a foothold on the target machine with at least a standard user account, making this a post-compromise privilege-abuse tool rather than an initial intrusion vector. The high C:H rating is the primary concern, as it suggests the leaked data could be meaningfully sensitive (e.g., tokens, credentials, or process memory from a higher-privileged context served by the notification service). No EPSS score was provided in the available data, making probabilistic exploitation likelihood unquantifiable from this dataset alone. The vulnerability is not listed in the CISA KEV catalog and no POC has been identified, further reducing urgency for most environments. The broad platform coverage - 19 distinct Windows versions including end-of-extended-support products like Server 2012 - elevates aggregate organizational exposure, particularly in environments running legacy Windows Servers. This is a patch-and-monitor priority, not an emergency response item, unless post-breach containment is an active concern.

A threat actor who has obtained a low-privileged local account on a vulnerable Windows system - through phishing, credential theft, or lateral movement - calls into the Windows Push Notifications service interface in a manner that triggers the uninitialized buffer read. The attacker captures the returned uninitialized memory contents, which may contain residual sensitive data from the notification service's address space such as authentication tokens, notification payloads from other users, or other process memory artifacts. No public exploit code has been identified at time of analysis, meaning exploitation currently requires independent vulnerability research to operationalize.