Windows Image Acquisition EUVD-2026-73520

Exploitation requires authenticated local access with at minimum low-privilege credentials on the target Windows system - PR:L in the CVSS vector confirms this. The AC:H rating indicates additional specific conditions must be met beyond basic access, likely involving the state of the WIA service, attached imaging hardware, or a particular API invocation sequence; the description does not enumerate these conditions precisely. Exploitation is bounded by: (1) local-only access (no network exploitation path), (2) at least one valid user account credential, and (3) unspecified high-complexity preconditions that limit reliable triggering. Defenders on systems with no imaging hardware or scanner peripherals can eliminate the attack surface by stopping and disabling the Windows Image Acquisition (stisvc) service.

Real-world priority for this vulnerability is moderate-to-low despite the C:H confidentiality impact. AC:H indicates specific preconditions must be met to trigger the out-of-bounds read, significantly reducing both opportunistic and automated exploitability. AV:L and PR:L require the attacker to already have authenticated local access to the target, limiting the attack surface to scenarios such as shared multi-user systems, post-compromise lateral movement, or insider threat. No CISA KEV listing, no published proof-of-concept, and the absence of an EPSS score in the input data all point to low observed exploitation. The breadth of affected Windows versions (19 distinct release/build combinations) does raise remediation scope, but the local-only access requirement and high complexity gate substantially reduce the blast radius compared to a network-exploitable information disclosure of similar CVSS score. This is a patch-and-monitor priority, not an emergency response item.

An attacker who has already obtained low-privileged local access to a Windows workstation or terminal server - for example, via a phishing-delivered remote access tool - invokes WIA APIs under specific conditions that trigger the out-of-bounds read, leaking kernel or process memory contents that could contain sensitive data such as credentials, encryption keys, or tokens. No public exploit code has been identified, and the high attack complexity means the attacker must engineer or discover the precise triggering conditions rather than firing a generic exploit.