Windows Sysmain EUVD-2026-99505

Exploitation requires local access to the affected Windows host with existing authenticated low-level privileges (CVSS PR:L) - the attacker must already be able to run code or interact with the Sysmain service as a logged-on user; it cannot be triggered remotely or by an unauthenticated party. No user interaction by a victim is needed (UI:N). The target must be an unpatched build below the fixed versions (e.g., Windows 11 24H2 <10.0.26100.9711, Windows 10 22H2 <10.0.19044.7807, Windows Server 2019 <10.0.17763.9376). The requirement for a pre-existing local foothold and valid credentials is the primary limiting factor; impact is confined to confidentiality disclosure with no integrity or availability effect.

This is a moderate-severity local information disclosure flaw in the Windows Sysmain service (CWE-497, exposure of sensitive system information to an unauthorized control sphere). Signals are consistent and point to a LOW real-world priority rather than an urgent threat: the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) requires local access and existing low-level privileges (PR:L) with no integrity or availability impact, and CISA's SSVC decision framework corroborates this with Exploitation: none, Automatable: no, and Technical Impact: partial. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The only tension is the C:H rating (high confidentiality impact) against an otherwise low-urgency profile - this reflects that a successful local attacker could read sensitive system memory/configuration data, but the local-and-authenticated precondition heavily constrains who can reach it. A patch is available from Microsoft, making this a routine 'patch in normal cycle' item rather than an emergency.

An attacker who already has a low-privileged authenticated foothold on a Windows host (e.g., a standard user account or a compromised low-privilege service) locally interacts with the Sysmain (SysMain/Superfetch) service to read sensitive system information it improperly exposes. No public exploit code has been identified, and the attack yields confidentiality-only disclosure (no code execution or tampering), which could aid later privilege escalation or lateral movement.