Windows HID EUVD-2026-43886

Exploitation requires a locally authenticated account with at least standard (low) privileges - PR:L in the CVSS vector confirms this. The attack vector is strictly local (AV:L), ruling out any remote or network-based exploitation path. High attack complexity (AC:H) indicates that exploitation is not straightforward against default HID subsystem behavior; the attacker likely must engineer specific conditions such as a particular I/O sequence, race condition, or device state. User interaction is not required (UI:N), so the attacker can operate independently once logged in. The impact is confined to information disclosure (C:H, I:N, A:N) - no code execution or denial of service. Limiting factors for defenders: no remote attack path, no unauthenticated path, no integrity or availability impact, and non-trivial exploitation complexity all combine to make this a lower-urgency finding outside of environments with high insider-threat exposure.

Real-world risk is modest despite the High confidentiality impact rating in the CVSS vector. The AV:L (local) attack vector eliminates remote exploitation entirely, and AC:H (high attack complexity) means the overflow condition is not trivially triggered - specific timing, input crafting, or system state is likely required. PR:L (low privileges) is the most notable risk factor, as any standard user account suffices, lowering the bar for internal threats or post-compromise lateral steps. EPSS at 0.30% (22nd percentile) and SSVC exploitation status of 'none' are consistent signals that no threat actors are currently weaponizing this flaw. The SSVC 'not automatable' rating further limits mass-exploitation scenarios. This is a real vulnerability worth patching on a normal patch cycle, but does not warrant emergency out-of-band response. No conflicting signals exist between CVSS, EPSS, and SSVC - all point to lower operational priority relative to network-exploitable or actively exploited vulnerabilities.

A local attacker with a standard Windows user account interacts with the HID subsystem - for example, through a crafted device I/O control call - in a manner that triggers an integer overflow in a size calculation, causing a read operation to access memory outside the intended buffer. The resulting memory content, potentially containing kernel addresses, process tokens, or other sensitive in-memory data, is returned to the attacker's user-mode context. No public exploit code is known at time of analysis, and the high attack complexity suggests successful exploitation likely requires environment-specific tuning.