Windows SMB EUVD-2026-44147

The attacker must possess a valid, authenticated local user account on the target Windows system (PR:L per CVSS vector). The Windows SMB service must be running, which is the default state on all affected Windows versions - no non-default configuration is required to expose the vulnerable code path. Exploitation is strictly local (AV:L): the attacker must be executing code on the affected machine, either via local console, RDP, or an existing foothold; no remote network-only attack path is confirmed. Limiting factors include: requirement for a valid local account (no anonymous or unauthenticated path), no automation path (SSVC Automatable: no), and no integrity or availability impact limiting the damage to read-only memory disclosure. Defenders can constrain realistic risk by limiting local logon privileges to essential personnel only.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 5.5 Medium) accurately characterizes a confined local-access threat: low complexity and no user interaction lower the barrier once inside, but the AV:L constraint requires the attacker to already be executing code locally on the target. The C:H metric indicates that disclosed memory could contain high-value data such as credentials or cryptographic material, but the attacker must already hold a valid local account (PR:L). SSVC reinforces low urgency: exploitation is assessed as none, the attack is not automatable, and technical impact is partial. No KEV listing and no known POC further confirm this is not under active exploitation. The overall risk profile is real but non-critical - a medium-severity finding suitable for inclusion in the next routine patch cycle rather than emergency remediation. No conflicting signals detected; CVSS and SSVC data are consistent.

A locally authenticated low-privilege user on an affected Windows system invokes SMB operations that trigger the uninitialized buffer code path, causing the SMB subsystem to return memory contents that were never zeroed during allocation. The attacker then parses the returned data to extract sensitive artifacts - such as fragments of other processes' memory, session tokens, or cryptographic material - present in the leaked region. No public POC is known at time of analysis, and SSVC classifies the attack as not automatable, suggesting exploitation requires deliberate, targeted effort rather than scripted mass exploitation.