Windows HID Parser EUVD-2026-99412

Exploitation requires local access to the Windows host plus low-level privileges (PR:L) - the attacker must already be able to execute code or interact with the HID subsystem as an authenticated user. The trigger is processing of a malformed HID (Human Interface Device) report/descriptor by the HID Parser Library, which could originate from a malicious or attacker-controlled USB/Bluetooth HID device or from a local process feeding crafted HID data. Limiting factors: no remote vector (AV:L), no capability for integrity or availability impact (I:N/A:N - confidentiality disclosure only), SSVC rates it non-automatable, and the authenticated-local prerequisite rules out unauthenticated or network-based attacks. Applies to the listed Windows 10, Windows 11, and Windows Server builds below their respective patched revisions.

This is a moderate-severity local information disclosure flaw (CVSS 5.5) whose signals are internally consistent and point to LOW real-world urgency despite affecting a ubiquitous platform. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) requires local access and low-level authentication, with impact limited to confidentiality (C:H, no integrity or availability effect). CISA's SSVC framework reinforces this: Exploitation=none, Automatable=no, Technical Impact=partial - meaning no observed exploitation and no path to automated mass attacks. There is no CISA KEV listing and no EPSS score was provided in the input, so exploitation probability cannot be quantified; however, the combination of SSVC 'Exploitation: none' and a local attack vector strongly suggests low likelihood of widespread opportunistic attacks. No public exploit is identified. Net assessment: a legitimate patch-management item (ubiquitous Windows footprint means broad applicability) but NOT an emergency - this is a high-prevalence, low-real-risk issue best handled in routine monthly patching rather than out-of-band response. Note: EPSS data is absent, so probabilistic exploitation ranking could not be cross-referenced.

An attacker who already has low-privileged local access to a Windows host (for example, a standard interactive user or a local account) crafts or supplies a malformed HID (Human Interface Device) report that the HID Parser Library processes, triggering an out-of-bounds read. The read returns adjacent memory contents, potentially leaking sensitive kernel or process data that could aid further privilege escalation. No public exploit code is identified at time of analysis, and the attack requires prior local authenticated access, substantially limiting opportunistic abuse.