Windows Function Discovery EUVD-2026-99942

Exploitation requires network reachability to the host's Function Discovery Service (the component implemented in fdwsd.dll, used for WSD/network device and resource discovery); the attacker sends traffic that the service parses, triggering the out-of-bounds read. Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and no special preconditions beyond the service being network-accessible are required. The practical limiting factor is exposure of the Function Discovery / WSD service to the attacker's network segment - in hardened environments this service is typically reachable only on local/trusted networks rather than directly from the internet, which constrains real-world attack surface. Impact is confined to information disclosure (C:H/I:N/A:N): no code execution, data modification, or denial of service results directly from this flaw.

This is a network-exploitable (AV:N), low-complexity (AC:L), unauthenticated (PR:N) out-of-bounds read requiring no user interaction (UI:N), scoring CVSS 7.5 with a pure confidentiality impact (C:H/I:N/A:N) - the high score is driven entirely by information disclosure, with no integrity or availability consequence. The signals are consistent but temper each other: CISA's SSVC framework rates Exploitation as 'none' (no observed or public exploitation) while marking it Automatable:yes with partial technical impact, indicating that IF an exploit emerges it could be scripted at scale, but none is known today. There is no CISA KEV listing and no public POC, so this is 'no public exploit identified at time of analysis' rather than active exploitation. EPSS was not provided in the input, so probabilistic exploitation likelihood cannot be quantified here. Net assessment: a genuine but second-tier priority - a memory-disclosure flaw in a ubiquitous Windows component that is remotely reachable and automatable, but with no confirmed exploitation and information-disclosure-only impact (useful primarily for leaking memory/ASLR data to chain with other bugs, not for direct compromise). Patch promptly on internet- or network-exposed hosts, but it does not warrant emergency out-of-band response absent new exploitation evidence.

A remote, unauthenticated attacker with network reachability to a host's Function Discovery Service sends a crafted request that triggers an out-of-bounds read in fdwsd.dll, causing the service to return adjacent process memory contents in its response. The leaked memory could expose sensitive data or defeat memory-layout protections (e.g., ASLR) to enable a follow-on exploit. No public exploit code has been identified at the time of analysis.