Windows Push Notifications EUVD-2026-43885

Exploitation requires an authenticated local session on the target Windows host with at minimum low-privilege (standard user) rights, confirmed by CVSS PR:L and AV:L. The attacker must execute code locally - remote unauthenticated exploitation is explicitly excluded by the Local attack vector. The vulnerability is specific to the Windows Push Notifications subsystem; only notification data transiting or stored by that component is at risk. No non-default configuration is identified as a prerequisite - Push Notifications is active by default on all affected Windows editions, so any unpatched system is susceptible when a low-privileged account is present. Risk is materially higher in multi-user environments (Remote Desktop Services, shared kiosks, VDI) where multiple users' notification data coexists on the same host. Factors limiting exploitation: local access is required (no network-based triggering); no user interaction from a victim is needed once access exists; SSVC Automatable: no indicates the technique cannot be reliably mass-deployed without per-target adaptation.

CVSS 5.5 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N captures a locally exploitable flaw: the High confidentiality sub-score is real but the local-only attack surface (AV:L) and requirement for an existing low-privilege session (PR:L) substantially limit real-world priority. SSVC reinforces this: Exploitation: none, Automatable: no, Technical Impact: partial - the flaw is not trivially chained at scale. EPSS at 0.36% (28th percentile) aligns with SSVC in showing no observed in-the-wild activity. The absence of a scope change (S:U) confirms blast radius is contained to the vulnerable system itself. Practical risk is highest in multi-session environments such as Remote Desktop Services farms or shared kiosk workstations, where multiple users' notification data coexists on the same host and a malicious or compromised low-privileged account could harvest cross-session notification payloads. For single-user endpoints, risk is low unless an attacker has already achieved initial access. No conflicting signals between available data sources were identified.

An attacker who has gained a standard user session on a Windows Remote Desktop Services host - for example, through phishing or credential theft - queries the Windows Push Notifications subsystem using a low-privileged process to enumerate and read notification payloads belonging to concurrently logged-on users, potentially capturing authentication tokens, message previews, or application-specific sensitive data embedded in cross-session notifications. No public exploit code exists at time of analysis, but the low attack complexity (AC:L) and absence of required user interaction suggest the technique is straightforward for an attacker already holding a local foothold.