Windows Print Driver EUVD-2026-99784

Requires the attacker to already have authenticated local, low-privilege access to the affected Windows system (PR:L, AV:L) and the ability to exercise the USB Print Driver code path. No user interaction by a victim is needed (UI:N). The exploitation is limited to information disclosure only (C:H, I:N, A:N) - it cannot by itself modify data or crash the system - and it cannot be performed remotely, which substantially narrows realistic exposure to scenarios where an attacker already has a foothold on the host. All listed Windows 10/11 and Windows Server builds (2012 through 2025, including Server Core) below the patched revisions are affected.

This is a genuine but lower-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5 Medium) describes a locally exploitable, low-privilege information-disclosure flaw with no integrity or availability impact and an unchanged scope - meaning the attacker must already have authenticated local access to the target host. All exploitation signals point the same direction and reinforce one another rather than conflict: CISA's SSVC decision framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial', and no EPSS score or KEV listing was provided in the input. There is no indication of public exploit code. The one mild tension worth noting is that the 'Buffer Overflow' tag and CWE-125 (out-of-bounds READ) imply a memory-safety condition, but C:H with I:N/A:N correctly reflects that this is a read/disclosure primitive, not a write/code-execution bug - so the 'Buffer Overflow' label overstates the impact class. Bottom line: a real, patch-worthy local information-disclosure issue, but not an urgent, mass-exploitable threat; prioritize via normal Patch Tuesday cadence rather than emergency response.

A low-privileged user already logged on to a Windows host (or malware running in that user's context) interacts with the USB print driver to trigger an out-of-bounds read, causing adjacent kernel/driver memory to be returned to the attacker. The disclosed memory could contain sensitive data or pointers useful for defeating ASLR as a stepping stone in a larger local privilege-escalation chain. No public proof-of-concept was identified in the provided data, and local access plus the required privileges limit the practical reach of the attack.