Microsoft Defender EUVD-2026-99076

Exploitation requires local access to a Windows host running Microsoft Defender for Endpoint (versions below 4.18.26060.3008) and pre-existing low-level privileges (PR:L) - the attacker must already be able to execute code or interact with the product as an authorized user. No user interaction by a victim is needed (UI:N). The primary limiting factors are the local-only attack vector (AV:L, no remote/network exploitation) and the authentication/privilege requirement, which together confine this to attackers who have already gained a foothold; the flaw yields only information disclosure (C:H, I:N/A:N) and cannot directly alter or crash the system.

This is a moderate-severity, locally-exploitable information disclosure flaw that does not warrant emergency prioritization. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) is internally consistent: exploitation requires local access and existing low-level privileges (PR:L, so the attacker is authenticated/already on the host), with high confidentiality impact but no integrity or availability impact - typical of an out-of-bounds read (CWE-125) that leaks memory contents. There is no CISA KEV listing, no EPSS score, and no public exploit code referenced in the provided data, so by the precision rules this is 'no public exploit identified at time of analysis.' No signals conflict: every indicator points to a low-urgency, defense-in-depth patch rather than a widespread or actively-exploited threat. The one caveat is scope - this affects Microsoft's own endpoint security agent, so a memory leak there could disclose security-sensitive data, modestly raising the practical value of the C:H rating. EPSS and KEV data are simply absent (not an error); their absence should not be read as either elevated or reduced risk.

A local attacker who already has a low-privileged foothold on a Windows endpoint (e.g., via a standard user account or a prior compromise) triggers the out-of-bounds read in Microsoft Defender for Endpoint to read memory beyond an intended buffer. This leaks sensitive in-memory data such as process contents or security material, aiding further privilege escalation or lateral movement. No public proof-of-concept is identified at time of analysis, and local access plus existing privileges (PR:L) are required, limiting opportunistic use.