EUVD-2026-99293
GHSA-95mj-2jqr-r568
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local session
-
ExploitLaunch process racing SmartScreen check
-
ExecutionWin TOCTOU timing window
-
ImpactDisclose protected information
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture TOCTOU prevention
|
| Exploitation Conditions | Exploitation requires the attacker to already hold a low-privileged, authenticated local session on the target Windows 11 machine (PR:L, AV:L) and to successfully win the race window in SmartScreen's time-of-check/time-of-use sequence. The high attack complexity (AC:H) is itself the primary limiting factor: the attacker must repeatedly and reliably hit a narrow non-deterministic timing window that is not under their control, which CISA's SSVC marks as Automatable=no. There is no remote or network path, no privilege escalation, and no user interaction required (UI:N); impact is confined to disclosure of information (C:H only) on the local system. |
| Impact | This is a low-to-moderate priority issue despite a CRITICAL-looking confidentiality impact. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) describes a locally-exploitable flaw requiring existing low-level authenticated access AND high attack complexity - the hallmark of a timing-dependent race condition (CWE-367) that an attacker cannot reliably trigger on demand. CISA's SSVC framework reinforces the low-urgency reading: Exploitation=none (no observed exploitation), Automatable=no (the race window cannot be dependably automated), and Technical Impact=partial. No EPSS score, CISA KEV listing, or public POC was provided in the input, and all signals are internally consistent - there is no network vector, no privilege-escalation, and no integrity/availability impact (I:N/A:N). The sole impact is information disclosure (C:H). Conclusion: a genuine but narrow local-information-disclosure bug in an ubiquitous product; it warrants patching through normal cycles rather than emergency response. No conflicting signals were detected. |
| Exploit ScenarioDerived | An attacker who already has a low-privileged authenticated session on a Windows 11 host runs a local process that repeatedly races the SmartScreen reputation/verification check, exploiting the window between the time-of-check and time-of-use to read information the process should not be able to access. Success is probabilistic and requires winning a tight timing window (AC:H), and no public exploit code was identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Windows SmartScreen on Windows 11 (versions 23H2, 24H2, 25H2 and 26H1) can be driven into disclosing local information through a time-of-check time-of-use (TOCTOU) race condition, but only by an attacker who already holds a low-privileged, authenticated local session (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, base 4.7). The high attack complexity is the dominant constraint: the attacker must reliably win a narrow, non-deterministic timing window that they do not control, which is why CISA's SSVC assessment records Exploitation=none and Automatable=no, and no public exploit code was identified at time of analysis. Impact is limited to confidentiality on the local host, with no remote path, no privilege escalation, and no integrity or availability effect; a vendor patch is available via the Microsoft MSRC update guide, and this should be treated as a low-to-moderate priority fix rather than an emergency despite the CRITICAL-looking confidentiality sub-score.
RemediationAI
Apply the vendor-released Microsoft security update for CVE-2026-83504 from the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83504); the fixed servicing revisions identified in the EUVD data are 10.0.22631.7582 for Windows 11 23H2, 10.0.26100.9445 for 24H2, 10.0.26200.9445 for 25H2, and 10.0.28000.2954 for 26H1, so patching to at least those builds removes the race. Because exploitation requires an authenticated low-privileged local session and a hard-to-win timing window, this does not warrant out-of-band emergency deployment ahead of the normal monthly cadence; schedule it with standard patch management and prioritize hosts that allow untrusted local users or run untrusted code. Until the update is installed, compensating controls are limited by the local-only attack surface: tighten local logon rights so that only trusted principals can interactively sign in or execute untrusted binaries (side effect: restricts shared/kiosk workstation use), keep Microsoft Defender's attack surface reduction rules and Tamper Protection enabled and block execution of user-writable paths (side effect: may break line-of-business installers that launch from user directories), and monitor for unusual or repeated SmartScreen/Defender reputation-check activity by non-admin users as a signal of race attempts. Disabling SmartScreen entirely is not recommended as a mitigation, since it would remove the reputation-based protection that the component provides and widen exposure to unrelated threats. No public exploit code was identified at time of analysis, so there is no urgent need to accept the functional trade-offs of these workarounds before the patch is deployed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-367, Time-of-Check Time-of-Use race condition, in the SmartScreen reputation/verification path of Windows 11. In a TOCTOU sequence, a resource (a file, path, handle or metadata value) is validated at one point in time and then re-referenced and acted upon at a later point, so an attacker who can influence the resource's state in the interval between the two operations can cause the software to use data that was never actually validated. Here the affected component is SmartScreen, the Windows Defender SmartScreen reputation filter that inspects downloaded files, Mark-of-the-Web-tagged content, and application launches before allowing or warning on them; because the vulnerable logic is reachable only from a local session, the CVSS vector is anchored at AV:L with PR:L, meaning the adversary must already have code execution as a low-privileged user on the machine. The AC:H rating and the SSVC verdict of Automatable=no reflect that the check/use window is short and scheduling-dependent, so exploitation is probabilistic rather than a deterministic single-shot trigger, and the scope is unchanged (S:U) with only confidentiality affected (C:H/I:N/A:N). The ENISA EUVD record (EUVD-2026-99293) enumerates the vulnerable Windows 11 servicing lines, and no CPE identifiers were supplied in the source data, so product identification rests on the EUVD build ranges and the Microsoft advisory.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Local-only TOCTOU race requires an authenticated foothold (PR:L) and a hard-to-win timing window (AC:H); impact is pure information disclosure, so C:H with I:N/A:N.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Time-of-check time-of-use (toctou) race condition in Windows SmartScreen allows an authorized attacker to disclose information locally.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Exploit-DB