Windows HTTP.sys EUVD-2026-99961

Exploitation requires LOCAL access to an affected Windows system with at least LOW privileges (PR:L) - i.e., the attacker must already be an authenticated/authorized user or control a low-privilege process on the host; there is no remote or network-reachable path (AV:L) and no user interaction is needed (UI:N). The flaw resides in the kernel-mode HTTP.sys stack and stems from reading an uninitialized resource (CWE-908); the description does not name a non-default feature or configuration prerequisite, so it appears to affect default installations of the listed Windows builds. Limiting factors that reduce realistic risk: the need for prior local foothold and valid low-level privileges, the confidentiality-only impact (no integrity or availability effect), and SSVC rating the flaw non-automatable. Affected builds are the pre-patch versions enumerated in EUVD-2026-99961 (e.g., Windows Server 2022 <10.0.20348.5761, Windows 11 24H2 <10.0.26100.9711); patched builds are not vulnerable.

All available signals point to a genuinely LOW-to-MODERATE real-world priority despite the CVE's presence in a ubiquitous component. The CVSS 3.1 base score is 5.5 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - exploitation is LOCAL (not network), requires LOW privileges (an authenticated/authorized attacker already on the host), and yields only a confidentiality impact (high C, no integrity or availability). CISA's SSVC decision framework reinforces this: Exploitation status is 'none', the flaw is NOT automatable ('no'), and technical impact is only 'partial' - collectively an SSVC 'Track' outcome rather than 'Act'. There is no CISA KEV listing and no public proof-of-concept, so exploitation status is 'no public exploit identified at time of analysis'. EPSS is NOT provided in the input, so probabilistic exploitation likelihood cannot be quantified - this is a data gap, not a low score. The signals are internally CONSISTENT (local vector, low privilege, info-disclosure-only, no known exploitation), so there is no conflict to flag beyond the missing EPSS. Net: this is a high-ubiquity-but-low-real-risk issue that merits routine patching rather than emergency response.

An attacker who already has low-privileged authenticated access to a Windows host (for example, a standard local or domain user, or a low-privilege service account) triggers an operation in the kernel-mode HTTP.sys stack that reads an uninitialized resource, causing residual kernel or process memory contents to be disclosed to the attacker. The leaked data (such as memory pointers or sensitive buffer remnants) could aid further privilege-escalation or defeat ASLR. No public exploit code has been identified, and the local attack vector plus required low privileges meaningfully constrain real-world abuse.