Windows File Explorer EUVD-2026-43785

Exploitation requires a valid authenticated local user session with at minimum standard (low-privilege) user rights on the affected Windows system, consistent with CVSS PR:L and AV:L. The attacker must be able to interact with Windows File Explorer - either via a local desktop session or a remote interactive session (e.g., RDP) that hosts an Explorer instance. No network-facing service or unauthenticated entry point is involved; purely remote exploitation without prior authentication is not possible. SSVC confirms the attack is not automatable, ruling out mass exploitation or worm-like propagation. The following factors limit exploitation: requirement for prior authentication with at least a standard user account, restriction to local/interactive attack surface only, no public proof-of-concept code, and no CISA KEV-confirmed active exploitation. On server systems where interactive logins are locked to administrators only (a common hardening baseline), this vulnerability presents effectively zero exploitable surface.

CVSS 5.5 Medium is appropriate for the technical severity: local access, low complexity, low privilege, high confidentiality impact, but no integrity or availability consequence. However, real-world urgency is further reduced by multiple converging signals. EPSS 0.31% (22nd percentile) places exploitation probability well below the median vulnerability. SSVC classifies exploitation as 'none,' automatable as 'no,' and technical impact as 'partial' - all pointing to a low-priority operational concern. No CISA KEV entry exists, and no public POC has been identified at time of analysis. The CVSS C:H rating reflects that arbitrary memory disclosure can be severe in theory, but the local-only prerequisite and absence of any exploitation activity substantially depress real-world risk. For multi-user Windows Server environments (terminal servers, VDI pools) where untrusted low-privilege users have interactive sessions, this warrants elevated attention given the confidentiality impact. For standard enterprise workstations with managed user accounts, this is a routine patch-cycle item. No conflicting signals were identified between data sources.

A low-privileged user authenticated to a shared Windows terminal server or workstation triggers a specific Windows File Explorer operation - such as navigating to a crafted directory, rendering a malformed file, or invoking a shell extension - that causes Explorer to read an uninitialized memory buffer. The disclosed memory contents, which may include residual heap data from other processes or prior user sessions, are surfaced to the attacker. Because no public POC has been identified, exploitation would require reverse-engineering the specific Explorer code path to craft a reliable trigger.