EUVD-2026-99175
GHSA-xv32-gjv8-95f3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local access
-
ExploitInteract with Remote POS Driver interface
-
ExecutionTrigger out-of-bounds read (CWE-125)
-
ImpactDisclose adjacent memory contents
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access to the affected Windows host with at least low-level user privileges (PR:L), and the ability to interact with the Windows Remote POS Driver component; it cannot be triggered remotely (AV:L). No user interaction is needed (UI:N). The impact is limited to information disclosure (C:H, I:N, A:N) - the attacker can read out-of-bounds memory but cannot modify data or affect availability. The requirement for pre-existing local authenticated access is the principal limiting factor reducing real-world risk. |
| Impact | This is a genuinely low-to-moderate priority issue despite its HIGH confidentiality impact. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) requires the attacker to already have local access and low-level privileges on the host, which sharply limits reach - this is not a remotely exploitable flaw. Multiple signals corroborate the low real-world urgency: it is NOT listed in CISA KEV, SSVC scores Exploitation as 'none' and Automatable as 'no', and SSVC rates Technical Impact only as 'partial' (consistent with an information-disclosure-only bug that has I:N/A:N). No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no public exploit identified at time of analysis. The signals are mutually consistent - no conflicts - pointing to a low-likelihood, limited-impact local information-disclosure vulnerability rather than a widespread threat. The main residual risk is as a secondary primitive in a local privilege-escalation or post-compromise chain (e.g., leaking memory contents such as pointers or secrets to defeat ASLR or harvest data). |
| Exploit ScenarioDerived | An attacker who has already gained a foothold on a Windows host as a low-privileged local user runs a crafted process or sends malformed input to the Remote POS Driver, triggering an out-of-bounds read that returns adjacent kernel or driver memory contents. The leaked data (such as memory addresses or sensitive buffers) could aid a follow-on exploit. No public proof-of-concept exploit is known, and the attack cannot be performed remotely or without local authenticated access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Information disclosure from an out-of-bounds read in the Windows Remote POS Driver allows an authenticated local user to read memory past the boundary of an intended buffer, potentially exposing sensitive data handled in kernel context. Exploitation requires local access with low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), needs no user interaction, and is limited to confidentiality impact - no integrity or availability effect - which caps real-world severity despite the HIGH confidentiality rating. No public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC: Exploitation = none, Automatable = no), and the requirement for pre-existing local authenticated access is the principal factor reducing risk.
RemediationAI
Patch status per vendor data: a fix is available from Microsoft. Apply the current cumulative/security update for each affected Windows build from the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70135); the version ranges in the input data indicate the first fixed builds as 10.0.22631.7652 for Windows 11 23H2, 10.0.26100.33650 for Windows Server 2025, 10.0.26100.9711 for Windows 11 24H2, 10.0.26200.9711 for Windows 11 25H2, 10.0.26300.9711 for Windows 11 26H2, 10.0.28000.3231 for Windows 11 26H1, 10.0.19044.7807 for Windows 10 21H2/22H2, 10.0.14393.9612 for Windows 10 1607 and Windows Server 2016, 10.0.17763.9376 for Windows 10 1809 and Windows Server 2019, and 10.0.20348.5761 for Windows Server 2022. Because the prerequisite is local access at low privilege and the impact is read-only disclosure, update prioritization can be moderate; where immediate patching is not possible, compensating controls include removing unnecessary local interactive logon rights and restricting which accounts may run on hosts that use point-of-sale peripherals, noting that this reduces the pool of potential callers but does not remove the flawed code path, and monitoring for unexpected access to the POS device interface, acknowledging that such detection is best-effort since the read itself is not destructive. Disabling or uninstalling the Remote POS Driver entirely on systems that do not use point-of-sale hardware eliminates the exposure, at the cost of breaking POS peripheral functionality on hosts that do need it; no other vendor-documented workaround is identified in the available data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 16 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a classic CWE-125 out-of-bounds read in a Microsoft Windows kernel-mode driver, the Remote POS Driver, which services point-of-sale peripheral communication on the local host. Flaws of this class typically arise when a driver trusts a length or offset field supplied through its device I/O control (IOCTL) interface or other local IPC surface and then reads further than the allocated buffer, or when an internal buffer is indexed without adequate boundary validation. Because the driver runs in kernel mode, the over-read can return adjacent kernel memory contents back to the calling process, which may disclose pointers or other internal state; the available data does not confirm any follow-on exploitation chain such as an ASLR bypass. The affected component is the driver itself rather than a network-facing service, and no CPE strings were supplied in the source data, so the affected Windows builds are identified from the EUVD version ranges instead. The CVSS vector (AV:L, PR:L, UI:N) confirms the attack surface is a local, low-privileged caller rather than a remote unauthenticated attacker.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local vector and low privilege required (AV:L/PR:L) per MSRC; out-of-bounds read yields confidentiality-only impact, so C:H with I:N and A:N.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Windows Remote POS Driver allows an authorized attacker to disclose information locally.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB