Windows iSCSI EUVD-2026-99275

Exploitation requires local access with valid low-privileged credentials on the affected Windows host (PR:L, AV:L) - it cannot be triggered remotely or by an unauthenticated user, and no user interaction of a victim is needed (UI:N). The attacker must reach the vulnerable Windows iSCSI code path; the description does not specify whether the iSCSI Initiator service must be running or specially configured, so verify whether the iSCSI feature must be active on the target. The limiting factors - required prior authentication, local-only vector, and confidentiality-only impact (no code execution or integrity/availability loss by itself) - mean realistic risk is primarily as a memory-disclosure primitive chained into other local attacks rather than standalone compromise.

This is a moderate-priority, low-urgency issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a locally exploitable out-of-bounds read requiring an already-authenticated low-privileged attacker on the host; it yields high confidentiality impact (memory disclosure) but no integrity or availability impact. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is 'no public exploit identified at time of analysis' rather than active exploitation. No EPSS score and no SSVC decision data were supplied, so automatability and exploitation-status signals from those frameworks cannot be evaluated - this absence is noted, not treated as low risk by default. Signals are internally consistent: the local attack vector, required privileges, and information-disclosure-only impact all point to a secondary/chaining bug (e.g., defeating ASLR or leaking sensitive kernel/driver memory) rather than a standalone critical. Net: patch on normal Patch-Tuesday cadence; it is not a high-real-risk emergency given local access is a prerequisite and no exploitation or POC is evidenced.

A low-privileged user already logged into a Windows host (or malware running in a low-integrity context) invokes an affected iSCSI driver code path with crafted input, triggering an out-of-bounds read that returns adjacent memory contents. The leaked data could include kernel pointers or secrets usable to bypass ASLR or stage a further local privilege-escalation chain. No public exploit code is identified, and the local-only vector with required authentication limits this to attackers who already have a foothold.