Windows File Explorer EUVD-2026-44263

The attacker must have local access to a Windows system running an unpatched version of File Explorer (any standard user session suffices - domain user, local user, or RDP session). The victim must interact with File Explorer during the attack window (UI:R), meaning either the attacker controls the local session themselves or must socially engineer a logged-in user to browse to a specific location. Exploitation is limited to confidentiality impact only - no code execution or system modification is possible via this flaw alone. Non-default conditions are NOT required; standard Windows desktop installations with File Explorer are vulnerable. Limiting factors: local access is required (no remote exploitation path), user interaction cannot be skipped, and no integrity or availability impact limits the attacker's post-exploitation options. Server Core installations are listed as affected but File Explorer is not installed in Server Core by default - administrators should verify whether the vulnerable shell component is present on Server Core systems.

Real-world risk is moderate-to-low despite the C:H confidentiality impact in the CVSS vector. The local attack vector (AV:L) and mandatory user interaction (UI:R) substantially constrain exploitability - an attacker would need physical or logical local access to a target system and would have to induce a user to interact with File Explorer. EPSS at 0.53% (41st percentile) reflects low community expectation of widespread exploitation, consistent with the SSVC assessment of Exploitation: none and Technical Impact: partial. CISA has not added this to KEV, confirming no observed active exploitation. The CVSS assigns PR:N (no privileges required), but this appears to describe any local logged-in user, not a fully unauthenticated network attacker - the local vector already constrains the attack surface. The combination of no KEV, low EPSS, local-only vector, and partial technical impact (confidentiality-only, no integrity or availability impact) means this is a real vulnerability warranting patching but not an emergency priority for most organizations. The primary risk scenario is insider threat or post-compromise lateral reconnaissance rather than opportunistic remote exploitation.

A local attacker with standard user access - such as a low-privileged insider or an adversary who has already gained a foothold on a workstation - opens or navigates a crafted directory in File Explorer, triggering the uninitialized memory read. The exposed memory contents could include fragments of other processes' heap or stack data, potentially yielding credentials, session tokens, or other sensitive artifacts. No public exploit code has been identified, so successful exploitation at this stage would likely require custom tooling.