Windows Storage EUVD-2026-73821

Physical access to the target Windows machine is required - the CVSS AV:P vector confirms this is not remotely exploitable under any network configuration. User interaction (UI:R) is additionally required, meaning the victim must perform some action that engages the Windows Storage code path while the attacker has access to observe or capture the leaked output; this cannot be triggered passively. No privileges or authentication are required of the attacker once physical proximity is established (PR:N). Exploitation is not automatable and cannot be delivered at scale. Impact is limited strictly to information disclosure (I:N, A:N) - no write primitives, no code execution, no availability disruption are achievable through this vulnerability alone.

The CVSS base score of 4.3 accurately reflects the dominant risk-reduction factor: physical access is mandatory (AV:P), which is incompatible with mass automated exploitation. SSVC corroborates this - exploitation rated none, automatable no, technical impact partial - and no KEV listing or public exploit code exists. EPSS data is absent from the provided intelligence, but the AV:P vector makes a low exploitation probability highly likely even without an explicit score. The C:H rating represents a theoretical worst-case scenario; the actual sensitivity of data exposed in the buffer over-read depends on what occupies adjacent memory at exploitation time, which may frequently be low-value data. The patch surface is broad - spanning over a dozen Windows version and SKU combinations from Server 2012 to Server 2025 - requiring systematic update deployment across large fleets, though urgency is low given the physical prerequisite. Organizations should prioritize patching internet-facing or high-value servers above general workstations, and enforce physical access controls as an independent mitigation layer. No public exploit identified at time of analysis.

An attacker with brief uncontrolled physical access to a Windows workstation - for example, an insider or a visitor with momentary device access - connects a crafted storage device or triggers a storage interaction that causes the victim user to engage the Windows Storage subsystem, inducing the buffer over-read. The attacker captures the leaked memory region, potentially extracting credentials, cryptographic keys, or session tokens that were resident in adjacent memory at that moment. No public exploit code exists, meaning this scenario currently requires custom exploit development and precise timing.