Windows Kernel-Mode Drivers EUVD-2026-99561

Exploitation requires local access to an affected Windows system with existing low-level privileges (PR:L) - an attacker must already be able to run code or read files as a logged-on user; it cannot be triggered remotely or by an unauthenticated party. The attacker must be able to reach the kernel-mode driver log file into which the sensitive information is written. Limiting factors: no remote vector (AV:L), required prior authentication (PR:L), and no user interaction of a victim is involved, so impact is confined to confidentiality on a host the attacker has already accessed. Patched builds for each affected Windows edition (per the EUVD version list) remediate the issue.

This is a moderate-severity local information-disclosure flaw (CVSS 5.5) whose real-world urgency is low. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) requires local access and existing low-level privileges (PR:L), limiting exposure to attackers who already have a foothold on the host; the only impact is high confidentiality loss with no integrity or availability effect, consistent with CWE-532 (sensitive information written to a log file). All exploitation signals point the same direction and do not conflict: SSVC rates Exploitation as 'none', Automatable as 'no', and Technical Impact as 'partial'; there is no CISA KEV listing and no public exploit identified. This should be treated as a routine patch-cycle item rather than an emergency - its priority comes from the ubiquity of Windows, not from any exploitation pressure. One caveat: the MSRC advisory text supplied here is terse, so the exact nature of the disclosed data and the log location are not confirmed from the provided data and would need verification against the vendor advisory.

An attacker who has already obtained a low-privileged local account on a Windows host (e.g., a standard user or a foothold from another compromise) reads a kernel-mode driver log file into which sensitive information has been improperly recorded, harvesting data they should not be able to see. No public exploit code is identified, and because it requires local authenticated access with no automation, it is most plausible as a post-compromise privilege/information-escalation step rather than an initial intrusion vector.