Windows WWAN Service EUVD-2026-73055

Exploitation requires a valid, locally authenticated user account with at least low-level privileges (PR:L) on the target Windows system; remote or unauthenticated exploitation is not possible per the AV:L/PR:L CVSS vector. The Windows Wireless Wide Area Network Service (wwan svc) must be present and running - it is typically active on systems with mobile broadband hardware or associated drivers installed, and may be absent or inactive on servers or workstations lacking cellular adapters. No special configuration flag, elevated privileges, or victim user interaction is required. Exploitation is strictly limited to information disclosure: CWE-125 provides a read-only primitive with no write capability or code execution path from this vulnerability alone. Systems without mobile broadband hardware or with the WWAN service explicitly disabled are not exploitable.

The CVSS 3.1 base score of 5.5 (Medium) accurately reflects a constrained risk profile: local-only attack vector (AV:L), low privilege required (PR:L), unchanged scope, and exclusively confidentiality impact (C:H/I:N/A:N). An attacker must already hold a valid low-privileged session on the target machine, eliminating the most dangerous remote exploitation scenarios. No CISA KEV listing and no public proof-of-concept are present in the provided intelligence, indicating no confirmed active exploitation at time of analysis. EPSS data was not supplied; absent KEV or POC, real-world exploitation probability is likely low. The primary concern is post-compromise chaining: leaked WWAN service memory contents such as credentials or tokens could aid privilege escalation or lateral movement. This warrants inclusion in a standard monthly patch cycle rather than emergency response.

A locally authenticated low-privileged user on a Windows system with the WWAN service active crafts an API call or structured input that causes the WWAN service to read beyond its allocated buffer boundary. Memory adjacent to the buffer - potentially containing credentials, session tokens, or configuration data held in the service process - is returned to the calling process. The attacker parses the disclosed memory to extract sensitive material usable for privilege escalation or lateral movement within the network. No public POC exists at time of analysis.