Windows Clipboard Service EUVD-2026-99985

Exploitation requires the attacker to already have an authenticated, low-privileged local logon session on the affected Windows host (PR:L, AV:L) and to be able to interact with the Clipboard User Service process locally; it cannot be triggered remotely or by an unauthenticated user. No special non-default configuration is indicated - the Clipboard User Service is a standard Windows component - but the local, authenticated prerequisite is the primary limiting factor, meaning an attacker must first gain a foothold on the machine. Impact is limited to disclosure of information (clipboard contents) with no integrity or availability effect.

This is a moderate-severity local information disclosure flaw in the Windows Clipboard User Service. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 5.5) indicates local attack vector with low complexity, requiring low privileges (PR:L, i.e. an already-authenticated local user) and no user interaction, yielding high confidentiality impact but no integrity or availability impact. All exploitation signals point to low real-world urgency: CISA's SSVC decision framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial', and there is no CISA KEV listing and no public proof-of-concept identified. No EPSS score was supplied in the input, so exploitation-probability cannot be quantified here - this is a data gap rather than a low score. The signals are internally consistent: a local-only, authenticated, non-automatable info-disclosure bug is a genuine but low-priority issue, not a high-severity remote threat. It should be patched in routine cycles; it is not a drop-everything emergency. Note the input tag 'Authentication Bypass' is a loose fit - the underlying weakness is CWE-863 Incorrect Authorization (an authorization flaw), which is distinct from authentication bypass; treat the tag with caution.

An attacker who already has a low-privileged authenticated session on a Windows host (e.g. a standard local user or a foothold from prior compromise) abuses incorrect authorization checks in the Clipboard User Service to read clipboard data belonging to other users or sessions that they should not be able to access. No user interaction is required and attack complexity is low, but execution must occur locally. No public exploit code has been identified at time of analysis.