EUVD-2026-73411
GHSA-65h5-jxxr-9864
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local-only exploitation requiring low-privilege auth; uninitialized resource read yields high confidentiality loss with no integrity or availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Use of uninitialized resource in Microsoft Account allows an authorized attacker to disclose information locally.
AnalysisAI
Uninitialized resource use in the Microsoft Account component on Windows allows a low-privileged local attacker to disclose sensitive information from memory. Affecting a broad swath of Windows client and server releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - the flaw exposes high-confidentiality data (potentially account tokens, credentials, or session state) with no user interaction required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local, authenticated session on the target Windows system with at minimum standard (low-privilege) user rights - the CVSS PR:L metric confirms this. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.5 score is reasonable given the local-only attack vector and purely confidential impact - integrity and availability are unaffected. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released security update via Windows Update or Microsoft Update Catalog; exact fix build numbers are documented in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68852 and correspond to the upper bounds listed per OS version (e.g., Windows 11 24H2 patched at 10.0.26100.9445). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today