Windows EUVD-2026-73444

Requires an authenticated local user session on the affected Windows system - corresponding to CVSS PR:L (low privileges). No network access is required; exploitation is constrained to the local machine. No special configuration of the Push Message Routing Service appears necessary based on available description - the service is presumed to run by default on affected builds. Exploitation is limited by the requirement to already have a local interactive or network logon session; remote unauthenticated exploitation is not possible given AV:L/PR:L. The absence of integrity and availability impact confines exploitation value to information disclosure, which may serve as a stepping stone rather than a standalone critical compromise.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N scores 5.5 (Medium), which is proportionate for this class of vulnerability: local access with low privileges is required, there is no integrity or availability impact, but the confidentiality impact is rated High, reflecting the potential to leak meaningful memory contents. No EPSS score was supplied in the input data, so exploitation probability is not independently quantifiable. This CVE does not appear in CISA KEV, and no public proof-of-concept has been identified at time of analysis, lowering immediate triage priority. Real-world risk is moderate: the vulnerability is constrained to local authenticated sessions, limiting remote attack surfaces, but in multi-tenant or shared-environment scenarios (RDS servers, VDI deployments, shared workstations) a low-privilege user could leverage the read to advance lateral movement or privilege escalation efforts. The input tags include 'Buffer Overflow', which is a mislabel - CWE-125 is an out-of-bounds read, not a write-based overflow, and the exclusively confidentiality-affecting CVSS vector corroborates the read-only nature of the flaw.

An attacker with a standard local user account on an unpatched Windows system sends a crafted request or triggers a specific code path in the Push Message Routing Service that causes it to read beyond the bounds of an allocated buffer. The out-of-bounds data returned to the attacker may include memory contents such as pointers, tokens, or session data that can be used to facilitate further privilege escalation or lateral movement within the system.