Windows Push Notifications EUVD-2026-35733

Exploitation requires an authenticated local session with at minimum low-privilege (standard user) access - confirmed by CVSS PR:L. The vulnerable code path lies within the Windows Push Notifications subsystem, meaning the feature must be operational (its default state on all affected Windows builds). No network access, no special configuration, and no user interaction from a second party are required. Exploitation is limited to local information disclosure only (S:U, I:N, A:N) - there is no lateral movement or remote trigger path. The primary limiting factor is physical or interactive local access (AV:L); remote exploitation over the network is not possible with this vulnerability.

The CVSS score of 5.5 (Medium) is anchored primarily by the High confidentiality impact (C:H), but the local-only attack vector (AV:L) and no integrity or availability impact (I:N/A:N) meaningfully constrain real-world risk. SSVC corroborates this: exploitation is rated 'none', automatable is 'no', and technical impact is 'partial' - indicating this is not a remotely weaponizable or wormable issue. EPSS data is not provided, but the combination of local-only access, standard-user privilege requirement, and no active exploitation signals a low-to-moderate priority for most enterprise environments. The primary concern is a post-compromise or insider-threat scenario where an attacker already holding a foothold uses this flaw to harvest sensitive data from notification memory. There is no conflict between CVSS vector and description - both consistently indicate local, authenticated exploitation.

A standard-privilege local user on an unpatched Windows system invokes a Push Notifications API or IPC mechanism that triggers allocation of an uninitialized buffer within the notification subsystem. The attacker reads the residual contents of that buffer, which may contain fragments of sensitive data from other processes or prior kernel operations. No public exploit code has been identified at time of analysis, so exploitation currently requires custom tooling.