Windows RPC Runtime EUVD-2026-99298

Exploitation targets the Windows RPC Runtime and requires the victim to interact - in practice, a Windows client must be induced to connect to or process a response from an attacker-controlled RPC server/endpoint (CVSS UI:R). No authentication is required of the attacker (PR:N), and the attack is over the network (AV:N), but the mandatory user/client interaction is the primary limiting factor: there is no autonomous, server-side, unauthenticated trigger against a default listening service, which aligns with CISA SSVC Automatable: no. Impact is limited to disclosure of uninitialized memory (C:H, I:N, A:N) - no code execution or tampering - and the leak is partial (SSVC Technical Impact: partial), typically requiring repetition to recover useful data. Affected systems are those running Windows builds below the patched versions listed in the EUVD advisory (e.g., Server 2012 through Server 2025, Windows 10 1607/1809/21H2/22H2, Windows 11 23H2 through 26H2).

This is a moderate, not top-priority, issue once all signals are weighed together. The CVSS 3.1 base score of 6.5 reflects a network-reachable (AV:N), low-complexity (AC:L), unauthenticated (PR:N) information-disclosure flaw in the Windows RPC Runtime with high confidentiality impact (C:H) but no integrity or availability impact (I:N/A:N) and unchanged scope (S:U). Crucially, the vector requires user interaction (UI:R), which is corroborated by CISA's SSVC decision of Exploitation: none, Automatable: no, Technical Impact: partial - three signals that all point away from spray-and-pray mass exploitation. There is no CISA KEV listing and no public proof-of-concept, so there is currently no public exploit identified at time of analysis. No EPSS score was supplied in the input, so probabilistic exploitation likelihood cannot be quantified here. The signals are internally consistent rather than conflicting: a network vector tempered by a hard requirement for a victim to initiate or accept interaction (typical of a client connecting to an attacker-controlled RPC endpoint), yielding memory disclosure rather than code execution. Bottom line: a genuine but conditional information-leak that should be patched on a normal cycle, not an emergency, absent any change in KEV or POC status.

An attacker stands up a malicious RPC endpoint and lures or coerces a Windows client into connecting to it (the UI:R requirement). Because an uninitialized resource is returned over the wire, the response leaks residual memory contents - potentially pointers, tokens, or fragments of sensitive data - back to the attacker. No public exploit code has been identified, and the leak must typically be repeated and reassembled to recover meaningful secrets.