Windows Management Instrumentation EUVD-2026-99556

Exploitation requires the attacker to already possess a local, authenticated foothold on the target Windows system (CVSS PR:L, AV:L) - it cannot be triggered remotely or anonymously. The attacker must be able to reach and invoke the affected Windows Management Instrumentation code path locally; no user interaction is required (UI:N) and attack complexity is low (AC:L) once local access is held. Limiting factors: the need for pre-existing local access and valid (low-privileged) credentials sharply constrains the realistic attacker population, and the impact is confined to information disclosure (C:H, I:N, A:N) - no code execution, integrity change, or denial of service. Patched builds are available for all affected Windows 10/11 and Windows Server versions listed in the EUVD data, so fully updated systems are not exposed.

This is a genuinely low-to-moderate priority issue, and the signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a local, low-complexity, low-privilege information-disclosure flaw with high confidentiality impact but no integrity or availability impact - exactly matching the description ('authorized attacker to disclose information locally'). CISA's SSVC framework reinforces this: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be mass-exploited), Technical Impact=partial. There is no CISA KEV listing and no public POC, so the exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. All available signals agree this is not a drop-everything item: it requires existing local, authenticated access and only leaks memory contents rather than enabling code execution or privilege escalation on its own. Its primary real-world value to an attacker would be as a secondary step (e.g., leaking memory to defeat ASLR or harvest secrets) once a foothold already exists. The main driver for patching is prevalence rather than severity - the affected product is Windows itself.

An attacker who already has a low-privileged local account on a Windows host invokes the vulnerable Windows Management Instrumentation code path to trigger an out-of-bounds read, causing adjacent process memory to be returned to the attacker. The leaked memory may contain sensitive data such as credentials, tokens, or address-layout information useful for chaining into further exploitation. No public exploit code is identified at time of analysis, and the local-only, authenticated vector means this cannot be triggered remotely or without an existing foothold.