Windows HID Parser EUVD-2026-99396

Exploitation requires local access to an affected Windows system as an already-authorized user (CVSS PR:L), with no user interaction needed. The attacker must be able to deliver crafted/malformed HID descriptor data to the HID Parser Library - for example through a malicious or emulated USB/Bluetooth HID device or a local process feeding HID input. Limiting factors: the attacker must first possess valid local credentials/session (no remote network vector, AV:L), impact is confined to information disclosure (C:H, I:N, A:N) with no code execution or system compromise by itself, and CISA's SSVC rates it non-automatable, meaning it does not lend itself to worm-like or scripted mass exploitation. Affected builds are below the patched versions listed per Windows edition in the EUVD data (e.g., Windows 11 24H2 before 10.0.26100.9711); patched systems are not exploitable.

This is a moderate, not urgent, priority. Every exploitation signal points to low real-world risk: SSVC from CISA records Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'; the vulnerability is not on the CISA KEV list and no public exploit code has been identified. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms the attack requires LOCAL access and existing low-level privileges (an authorized/authenticated user), which sharply limits scope versus a network-facing flaw. The 5.5 Medium score is driven entirely by confidentiality impact (C:H, I:N, A:N) - an out-of-bounds read that can leak memory contents, with no integrity or availability effect. The signals are internally consistent (local vector in CVSS matches the 'locally' wording in the description and SSVC's non-automatable assessment), so there is no conflict to flag. Bottom line: a genuine information-disclosure bug worth patching in normal cycles, but it is a high-privilege, local-only, hard-to-automate issue rather than a mass-exploitation threat.

An attacker who already has a foothold on a Windows system as an authorized low-privileged user supplies crafted HID (Human Interface Device) descriptor data - for example via a malicious or emulated USB device or a local process interacting with the HID stack - that triggers the HID Parser Library to read beyond allocated bounds. The resulting out-of-bounds read leaks adjacent memory contents, potentially exposing sensitive kernel or process data useful for further privilege escalation. No public proof-of-concept exploit has been identified at time of analysis, and the local, low-automatability nature makes opportunistic mass exploitation unlikely.