Windows HID Parser EUVD-2026-99407

Requires local, authenticated access to an affected Windows system (AV:L, PR:L) and the ability to cause the HID Parser Library to process attacker-influenced HID descriptor/report data - for example by attaching or emulating a malicious USB HID device or feeding crafted HID report structures to the parser. No user interaction is required (UI:N). Exploitation is limited by the need for existing low-privilege local access, the non-automatable nature of the flaw (SSVC Automatable: no), and impact restricted to information disclosure with no integrity or availability effect; affected builds span Windows 10 (1809/21H2/22H2), Windows 11 (23H2 through 26H2), and Windows Server 2019/2022/2025, all fixed in the vendor-patched build numbers listed in EUVD.

This is a moderate, not high-priority, issue. The CVSS 3.1 base score of 5.5 reflects a local attack vector (AV:L), low complexity (AC:L), and a requirement for low-level privileges (PR:L) with no user interaction, yielding only confidentiality impact (C:H/I:N/A:N) - i.e., a local information-disclosure read, not code execution. All exploitation signals point the same (low) direction: CISA's SSVC decision framework records Exploitation as 'none', Automatable as 'no', and Technical Impact as 'partial', and there is no CISA KEV listing and no public proof-of-concept in the provided data, so the status is no public exploit identified at time of analysis. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified from this data. The signals are internally consistent: a local, authenticated, non-automatable memory-disclosure bug in a ubiquitously deployed Windows component. The main driver of real-world concern is prevalence (the HID Parser Library ships in all supported Windows versions) rather than exploitability; because an attacker already needs local authenticated access and the impact is limited to reading memory, this is a patch-on-normal-cadence item rather than an emergency.

A locally authenticated attacker on a Windows host supplies crafted HID (Human Interface Device) descriptor data - for example via a malicious or emulated USB device or a crafted report - that the HID Parser Library parses incorrectly, triggering an out-of-bounds read. The attacker uses the leaked memory contents to disclose sensitive kernel or process data that may aid further privilege escalation. No public exploit code is identified at time of analysis, and the local vector plus required privileges limit practical reach.