Windows Task Scheduler EUVD-2026-73113

Requires an authenticated local session with at least standard user (low-privilege) account access on an affected Windows build - no administrative rights are needed. Exploitation is entirely local (AV:L); no network access or inbound connection is required. No special configuration or non-default feature must be enabled, as Task Scheduler is a core Windows component active by default. Exploitation is limited to reading memory contents from the vulnerable path; no write or execution primitive is provided. The primary limiting factor is the mandatory local interactive or terminal session, which prevents remote unauthenticated exploitation and sharply reduces the attack surface compared to the network-facing CVEs in the same Windows patch cycle.

The provided CVSS score of 5.5 (Medium) accurately reflects the constrained attack surface: exploitation requires an existing local session with at least standard user privileges, and the impact is limited to confidentiality (C:H, I:N, A:N). In a single-user workstation context this is low priority, but in multi-user environments - shared Windows Server systems, Remote Desktop Services hosts, or terminal servers - a low-privileged session holder could leverage this to extract sensitive data belonging to higher-privileged processes or sessions, elevating practical impact. No EPSS data was supplied, no KEV listing exists, and no public proof-of-concept has been identified, suggesting no active exploitation at time of analysis. The breadth of affected OS versions (six distinct Windows 10/11 branches plus four Server editions) increases enterprise exposure in terms of patch surface, though the local-only vector meaningfully caps real-world exploitability. No conflicting signals between the CVSS vector and the description - both consistently point to a local, low-privilege, read-only disclosure path.

An attacker with a standard (low-privilege) local Windows account on a patched-lagging Windows Server 2019 Remote Desktop host triggers a specific Task Scheduler code path that reads from an uninitialized memory buffer, receiving stale memory contents that may include credentials, session tokens, or sensitive process data belonging to a co-resident privileged session. No public proof-of-concept exists at time of analysis, but the low attack complexity (AC:L) suggests the trigger condition is straightforward once the code path is identified.