Windows WPD Driver EUVD-2026-99939

Exploitation requires an attacker to already possess an authenticated low-privileged local session on the Windows host (CVSS PR:L, AV:L) and the ability to interact with the Windows Portable Device (WPD) File System driver - the component is present by default in Windows, so no special feature toggle is documented, but the flaw cannot be reached remotely or without prior local code execution/account access. Limiting factors: there is no network vector, no privilege escalation or data modification from this bug alone (I:N/A:N), SSVC marks exploitation as not automatable, and the affected system must be running an unpatched build below the fixed versions enumerated in EUVD (e.g., Windows 11 24H2 below 10.0.26100.9711, Server 2022 below 10.0.20348.5761). The practical value is as a local information-leak/privilege-escalation aid rather than an independent compromise.

This is a moderate-priority, low-urgency issue that should be patched on a normal cycle rather than treated as an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a locally-exploitable flaw requiring an already-authenticated low-privileged user, with high confidentiality impact but no integrity or availability impact - consistent with a memory-disclosure/information-leak primitive rather than code execution. All exploitation signals point the same direction and do not conflict: CISA SSVC records Exploitation=none, Automatable=no, and Technical Impact=partial, indicating no observed exploitation and no path to mass/automated attack. The CVE is NOT in CISA KEV and there is no POC in the provided data, so this is 'no public exploit identified at time of analysis.' EPSS was not supplied, so the probabilistic exploitation estimate is unknown and cannot be weighed. The high confidentiality rating is somewhat offset by the local attack vector and the PR:L requirement, meaning an attacker must already have a foothold (valid local account or code execution as a standard user) before this becomes useful - most realistically as a local privilege-escalation building block or sandbox/info-leak aid rather than a standalone remote threat. Net: a genuine but contained local information-disclosure bug, not a high-real-risk internet-facing issue.

An attacker who already has a low-privileged local session on a Windows host (e.g., a standard user or malware running in a limited context) interacts with the Portable Device (WPD) File System driver to trigger a type-confusion condition that causes the driver to read and return memory it should not expose. The leaked kernel or cross-context data could reveal sensitive information or defeat memory-layout protections, aiding a follow-on privilege-escalation chain. No public exploit is identified at time of analysis, and the attack requires local access with no remote or unauthenticated path.