Windows Clipboard Service EUVD-2026-99408

Exploitation requires the attacker to already have authenticated, low-privileged local access to the Windows host (CVSS PR:L, AV:L) and to interact with the Windows Clipboard User Service component; no user interaction is needed (UI:N). The key limiting factors are the mandatory local foothold and pre-existing valid credentials - this cannot be reached remotely or by an unauthenticated actor - and the impact is restricted to disclosure of sensitive system information (C:H, with no integrity or availability impact), which caps the damage to confidentiality only.

This is a moderate-severity, low-priority local information disclosure flaw (CWE-497) in the Windows Clipboard User Service, and the available signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) requires local access and existing low-level privileges, with impact confined to confidentiality only (no integrity or availability impact). CISA's SSVC decision framework reinforces the low-urgency reading: Exploitation is 'none', the flaw is NOT Automatable ('no'), and Technical Impact is only 'partial' - all pointing toward Track rather than Act. There is no EPSS score in the input, no CISA KEV listing, and no public POC, so no public exploit identified at time of analysis. The high confidentiality rating (C:H) is the only notable signal, but because exploitation demands an authenticated local foothold and cannot be automated at scale, this is a genuine but low-priority patch-management item, not an emergency - it is the kind of local privilege-adjacent info-leak that matters mainly as one link in a larger post-compromise chain, not as an initial access vector.

An attacker who already has low-privileged, authenticated access to a Windows host (for example, a standard user account or a foothold from a prior compromise) interacts locally with the Clipboard User Service to read sensitive system information they should not be able to see. No user interaction is required, but local presence and valid credentials are, so this realistically serves as a post-exploitation information-gathering step rather than a remote entry point. No public exploit identified at time of analysis.