Windows SCSI Class EUVD-2026-73805

Requires user interaction (UI:R) - a Windows user must actively access or interact with an attacker-controlled network storage resource (e.g., a crafted SMB share, network path, or iSCSI target) to trigger the vulnerable code path in the SCSI Class System File driver. No authentication is required from the attacker side (PR:N). The attack is network-accessible (AV:N), meaning the attacker does not need local or adjacent network access beyond standard internet or LAN reachability. Low attack complexity (AC:L) indicates no race condition or special timing is required. Exploitation is not automatable per SSVC (consistent with UI:R), limiting bulk/worm-style propagation. The impact is limited to information disclosure - no code execution, no integrity or availability impact results directly from this vulnerability alone.

The CVSS 6.5 score (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects a meaningful but bounded risk: confidentiality impact is high, but exploitation requires user interaction (UI:R), constraining mass automated exploitation. The SSVC framework corroborates this - Automatable: no directly mirrors UI:R, and Technical Impact: partial aligns with the disclosure-only profile. No EPSS score is provided in the input data, so exploitation probability cannot be quantified numerically. No public exploit code exists, and CISA has not added this to KEV at time of analysis. The breadth of affected Windows versions (Server 2012 through Windows 11 26H1) increases the total exposed population significantly, even if per-host risk is moderate. The pure C:H/I:N/A:N vector means successful exploitation does not grant code execution or persistent access on its own, though leaked kernel memory could facilitate further exploitation as a prerequisite step (e.g., ASLR bypass). Vendor patch is confirmed available; prompt patching is the primary action.

An attacker hosts or presents a crafted network storage resource (such as a malformed SMB share or iSCSI target exposing a manipulated SCSI response); when a targeted Windows user browses or connects to that resource, the SCSI Class driver processes the malformed SCSI data and the integer underflow causes an out-of-bounds read, returning kernel memory contents to the attacker. No public exploit code exists at time of analysis, and the required user interaction step limits opportunistic mass exploitation.