EUVD-2026-99344
GHSA-hg95-xf83-pww7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local session
-
DeliveryInvoke vulnerable Servicing Stack Update path
-
ExploitTrigger buffer over-read (CWE-126)
-
ExecutionRead out-of-bounds adjacent memory
-
ImpactDisclose sensitive information locally
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer over-read prevention
|
| Exploitation Conditions | Exploitation requires an attacker to already possess an authenticated local foothold (PR:L) on the Windows system - there is no remote or network vector (AV:L) and no user interaction is needed (UI:N). The attacker must be able to reach the Servicing Stack Updates code path that performs the out-of-bounds read; no special non-default product feature or configuration is indicated in the description. Limiting factors: local access only, pre-existing low-level credentials, and an impact ceiling of memory disclosure (C:H, I:N, A:N) with no code execution or tampering, which substantially constrains real-world severity. |
| Impact | This is a moderate, low-priority issue despite affecting a ubiquitous platform. The CVSS 3.1 base score of 5.5 is driven entirely by high confidentiality impact (C:H) with no integrity or availability effect, and the vector confirms local attack surface (AV:L), low complexity (AC:L), and required low-level privileges (PR:L) - i.e., an already-authenticated local user. Multiple signals agree that this is NOT an urgent threat: it is absent from CISA KEV, no public exploit code is referenced, and CISA's SSVC framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as 'partial'. These are mutually consistent - a local information-disclosure buffer over-read is hard to automate at scale and yields only memory disclosure rather than code execution. The main caveat is that the only references are MSRC and NVD stubs with no detailed writeup, so the exact nature of the disclosed information (e.g., kernel memory, other-process data) cannot be confirmed from the provided data. Net: a legitimate patch-in-normal-cycle item, not a high-real-risk emergency, notwithstanding its presence across the entire Windows fleet. |
| Exploit ScenarioDerived | An attacker who already has a low-privileged authenticated session on a Windows host runs a crafted local operation that invokes the vulnerable Servicing Stack Updates code path, triggering a buffer over-read. The out-of-bounds read returns adjacent memory contents to the attacker, potentially disclosing sensitive data that aids further local privilege escalation or reconnaissance. No public exploit is identified, and the local-only vector with low (but non-zero) privilege requirement limits this to attackers already present on the system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Local information disclosure in the Microsoft Windows Servicing Stack (the component that installs and maintains Windows Updates) allows an authenticated attacker who already holds a low-privileged local foothold to trigger an out-of-bounds memory read and leak contents of process memory. Tracked as CVE-2026-83719 with a CVSS 3.1 base score of 5.5 (AV:L/PR:L/UI:N, C:H/I:N/A:N, CWE-126), it affects a broad set of supported Windows 10, Windows 11 and Windows Server builds, and Microsoft has published a vendor-released fix. Exploitation is assessed as not active and not automatable (CISA SSVC: exploitation none, automatable no), no public exploit code has been identified at time of analysis, and because the impact is confined to confidentiality and requires pre-existing local credentials, real-world severity is moderate and low priority.
RemediationAI
Primary fix: apply the vendor-released Microsoft servicing stack / cumulative security update for each affected build - Windows 11 23H2 at 10.0.22631.7652 or later, 24H2 at 10.0.26100.9711 or later, 25H2 at 10.0.26200.9711 or later, 26H1 at 10.0.28000.3231 or later, 26H2 at 10.0.26300.9711 or later; Windows Server 2019 / Windows 10 1809 at 10.0.17763.9376 or later; Windows 10 21H2/22H2 at 10.0.19044.7807 or later (verify the correct 22H2 build); Windows Server 2022 at 10.0.20348.5761 or later; and Windows Server 2025 at 10.0.26100.33650 or later. Patches are delivered through normal Windows Update / WSUS channels and are catalogued in the Microsoft Security Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83719; the advisory URL is the authoritative source for KB numbers per edition and should be checked before deployment in case build thresholds differ for specific SKUs. Because Servicing Stack Updates are a core component of the update pipeline, they cannot be disabled or uninstalled to remove the vulnerable code path, so there is no clean feature-level workaround - do not attempt to block Windows Update or servicing as a mitigation, as doing so both fails to address the over-read and defers other security fixes. The realistic compensating controls target the required prerequisite, namely a low-privileged authenticated local session: restrict interactive logon and RDP logon rights ("Allow log on locally" and "Allow log on through Remote Desktop Services") to the minimum necessary user set, and apply least privilege so that standard accounts cannot run arbitrary code on the host; the trade-off is reduced flexibility for shared or multi-user workstations and potential disruption of legitimate remote-support workflows. Additionally, tightly control who can reach the servicing code path by limiting local execution of tooling that manipulates CBS/servicing state to administrators, and treat any anomalous memory-disclosure-adjacent activity (for example, ASLR-bypass-oriented probing from non-administrative sessions) as a detection signal. These controls reduce exposure but do not eliminate the flaw - patching remains the only complete remedy. No vendor-released mitigation that removes the out-of-bounds read without installing the update was identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 13 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected technology is the Windows Servicing Stack, the CBS (Component Based Servicing) / Windows Update installation pipeline that stages, applies and rolls back OS component updates, largely operating under the TrustedInstaller service account. The root cause is classified as CWE-126 (Buffer Over-read): a routine in the servicing stack reads past the end of an allocated buffer instead of validating the length or bounds of the input it is parsing, so data beyond the intended object is copied into a location the attacker-influenced code path can observe. In contrast to CWE-787 (out-of-bounds write) or CWE-122 (heap overflow), an over-read cannot by itself corrupt memory or achieve code execution - its value to an attacker is the leaked memory content, which can expose pointer values, security cookies or other privileged heap data useful for defeating ASLR or for reconnaissance ahead of a separate exploit. The assessed vector is AV:L/PR:L/UI:N with C:H/I:N/A:N, confirming the attacker must already be able to execute code or issue servicing operations locally as an authenticated low-privileged user and that no network path or user interaction is involved. No CPE strings were supplied in the available intelligence; affected product identification comes from the EUVD/vendor build-level version ranges.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Authorized local attacker triggers an out-of-bounds read, so AV:L and PR:L; low complexity; impact is confidentiality-only memory disclosure, hence C:H with I:N and A:N.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Buffer over-read in Servicing Stack Updates allows an authorized attacker to disclose information locally.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Exploit-DB