Windows KSP EUVD-2026-99659

Exploitation requires an authorized local attacker (PR:L) with an existing low-privileged authenticated session on the target Windows system - there is no remote or unauthenticated path. The attacker must be able to invoke the Windows Key Storage Provider (KSP) cryptographic interface to trigger the out-of-bounds read; no end-user interaction (UI:N) and no special non-default configuration are indicated by the advisory. Limiting factors that reduce real-world risk: the need for prior local access and valid credentials, the read-only nature of the flaw (no code execution, no data modification), and CISA's assessment that exploitation is not automatable. Affected systems are those running Windows builds below the patched versions listed in EUVD (e.g., Windows 11 24H2 below 10.0.26100.9711, Server 2025 below 10.0.26100.33650); patched builds are not exploitable.

This is a moderate-severity, low-priority issue in practice. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a local, low-complexity, authenticated (PR:L) information-disclosure flaw with high confidentiality impact but no integrity or availability impact. All exploitation signals point the same direction and are mutually consistent rather than conflicting: CISA's SSVC decision framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial', and there is no public exploit identified at time of analysis and no CISA KEV listing. The combination of a required local presence, existing low-privilege authentication, and a read-only out-of-bounds (CWE-125) primitive that leaks memory contents means this is not a remotely wormable or mass-exploitable bug - it is best treated as a privilege-boundary/defense-in-depth memory-disclosure issue useful as one link in a larger local attack chain (e.g., leaking key material or pointers to defeat ASLR). No signals are missing for a risk call, though note the input 'Buffer Overflow' tag is imprecise: CWE-125 is an out-of-bounds read (memory over-read), not a classic overflow write, consistent with the information-disclosure-only impact.

A local attacker who already has a low-privileged authenticated session on a Windows host triggers an out-of-bounds read in the Key Storage Provider, causing it to return adjacent process memory. The disclosed bytes may contain sensitive material (cryptographic key fragments, handles, or memory addresses) that the attacker uses to further an escalation or key-recovery effort. No public exploit code has been identified, and exploitation is not automatable per CISA SSVC.