EUVD-2026-73439
GHSA-wj82-f9fc-8qcg
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local access with low-privilege user account sufficient; pure confidentiality impact only, no integrity or availability effect.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Generation of error message containing sensitive information in Microsoft COM for Windows allows an authorized attacker to disclose information locally.
AnalysisAI
Microsoft COM for Windows leaks sensitive information through error messages on a wide range of Windows 10, Windows 11, and Windows Server versions, allowing a locally authenticated attacker with standard user privileges to read high-confidentiality data. The flaw is rooted in CWE-209 (error message content exposure), where COM subsystem error paths disclose internal state that should not be visible to unprivileged callers. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid local account with at minimum standard (non-administrative) user privileges on the affected Windows system; remote network access alone is insufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.5 score with a local attack vector reflects a moderate but real risk: low-privileged users on shared or multi-tenant Windows systems-including Remote Desktop servers, enterprise workstations, and Citrix environments-could leverage this to extract sensitive COM-layer data that may include internal addresses useful for bypassing ASLR in follow-on attacks or, in worst cases, credential material. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft security update available through Windows Update, WSUS, or the Microsoft Update Catalog; the advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69294 links to the specific KB articles and build numbers for each affected Windows version listed above. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-209 – Error Message Information Leak
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today