Windows 11 26h1
Monthly
Heap-based buffer overflow in Windows DNS Server allows an authenticated, low-privilege attacker with network access to disclose sensitive information from server memory. The vulnerability affects numerous Windows Server and Windows 10/11 builds that have the DNS Server role installed, with no public exploit identified at time of analysis. Although rated CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, the confidentiality-only impact and requirement for authentication limit the realistic threat to information leakage rather than code execution or denial of service.
Heap memory disclosure in Microsoft Windows Hyper-V lets an authenticated, low-privileged principal - such as an account inside a guest VM or a low-rights user able to reach the Hyper-V service over the network - read leaked contents of the hypervisor's heap, affecting Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2019, 2022, and 2025 including Server Core installations. The flaw carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning no user interaction and low attack complexity are required, but the attacker must already hold valid credentials and the outcome is read-only: confidentiality is fully impacted while integrity and availability are untouched, so hosts without the Hyper-V role enabled are not exposed. No public exploit been identified at time of analysis, and Microsoft has published fixed builds via its MSRC update guide.
Local tampering in the Windows Container Isolation FS Filter Driver (unionfs.sys) lets an authenticated attacker redirect file operations to an attacker-chosen destination. A low-privileged user who can create or control a symbolic link, junction, or reparse point that unionfs.sys resolves during a file operation can exploit improper link resolution (CWE-59) to modify or overwrite files the driver handles, affecting Windows 11 24H2, 25H2, 26H1 and 26H2 plus Windows Server 2022 and 2025 builds prior to their patched levels. The flaw is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), meaning local authenticated access is a prerequisite and only integrity is impacted; no public exploit code has been identified and CISA's SSVC assessment records exploitation as none and automatable as no, so real-world urgency is low.
Local information disclosure in the Windows Client Side Caching driver (csc.sys) lets an authenticated attacker who already holds low-level privileges on a Windows host read sensitive data that should be restricted, such as contents of the Offline Files cache. The flaw affects default installations across Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, and requires only local access with no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5). There is no public exploit identified at time of analysis, CISA's SSVC rates exploitation as 'none' and the issue as non-automatable with partial technical impact, and Microsoft has released patched builds - making this a post-compromise disclosure primitive rather than a remote entry point.
Information disclosure in the Microsoft Windows Storage component lets an authenticated local attacker read sensitive data that the service places in a file or directory reachable by lower-privileged users (CWE-538). Exploitation requires a valid low-privileged interactive session on an unpatched host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), so it cannot be triggered remotely or by an unauthenticated user, and the impact is confidentiality-only (C:H, I:N, A:N) with a base score of 5.5. Microsoft has released fixes, CISA's SSVC assessment rates exploitation as 'none' with automatable 'no', and no public exploit code has been identified at time of analysis, making this a moderate-severity hardening item rather than an urgent remote threat.
Local privilege escalation in the Windows Distributed File System (DFS) lets an authenticated attacker with valid host credentials trigger a heap-based buffer overflow (CWE-122) and elevate to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. Exploitation is local only with no user interaction and, per Microsoft's advisory, requires existing high privileges, so realistic exposure is limited to shared, multi-user, or terminal-server hosts where an untrusted authenticated principal is present. No public exploit code has been identified at time of analysis and CISA's SSVC rates exploitation as none; vendor patches are available.
Information disclosure in the Windows NTFS file system driver allows an authenticated local attacker to read sensitive system information that should be restricted to a higher privilege level. The flaw affects Windows 10, Windows 11, and Windows Server installations on NTFS volumes below their respective patched builds; exploitation requires pre-existing local code execution or interactive access as a low-privileged user (CVSS PR:L), with no remote vector and no user interaction (UI:N). No public exploit code has been identified at time of analysis, and Microsoft has released vendor patches.
An out-of-bounds read in the Windows Universal Disk Format File System (UDFS) kernel-mode driver lets a locally authenticated attacker disclose information - potentially kernel memory contents - on an affected host. Exploitation requires existing local access and the ability to feed crafted UDF-formatted content (a mounted ISO/UDF image, removable USB media, or a virtual volume) to the driver; the vulnerability is not remotely reachable, cannot be triggered unauthenticated, and has no integrity or availability impact, which is why CISA's SSVC rates it non-exploited and non-automatable. Microsoft has shipped fixed builds for every affected Windows 10, Windows 11, and Windows Server release, and no public exploit code has been identified at time of analysis, making this a moderate-severity, low-priority issue despite affecting a kernel-mode component present by default on all listed platforms.
An out-of-bounds read in the Windows NTFS file system driver (ntfs.sys) lets an authenticated local user with low privileges read memory contents beyond an allocated buffer, resulting in local information disclosure (CWE-125, CVSS 3.1 5.5). Only hosts that have not applied Microsoft's current cumulative updates are affected; the EUVD data lists a broad range of client and server branches below their respective fixed builds (?fix versions include Windows 11 23H2 10.0.22631.7652, 24H2 10.0.26100.9711, 25H2 10.0.26200.9711, Windows 10 1607/Server 2016 10.0.14393.9612, and Windows 10 1809/Server 2019 10.0.17763.9376). There is no remote vector and CISA SSVC rates the flaw as non-automatable with only partial technical impact, and no public exploit code has been identified at time of analysis, so this is a genuine but low-priority disclosure primitive rather than a path to privilege escalation.
Information disclosure in the Microsoft Windows NTFS filesystem driver allows a local, low-privileged, authenticated attacker to read portions of kernel memory by triggering an integer underflow (wraparound) during a crafted NTFS operation, with no user interaction required. Exploitation is confined to the local attack vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and yields confidentiality impact only (C:H/I:N/A:N, score 5.5) - there is no write, code-execution, or denial-of-service effect, and CISA's SSVC analysis rates the issue as not automatable with no known exploitation. No public exploit code has been identified at time of analysis, and Microsoft has released a vendor patch covering all affected Windows client and server builds.
Information disclosure in Windows Message Queuing (MSMQ) Queue Manager allows an authenticated local attacker to read data from an affected host via a type confusion flaw. Exploitation requires the optional MSMQ feature to be installed and the Queue Manager service running (not enabled by default), and impact is limited to confidentiality with no code execution or privilege escalation. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Local information disclosure in the Microsoft Windows Search Component lets an authenticated low-privileged user read out-of-bounds memory contents on the affected host, giving a post-foothold attacker a confidentiality-only leak (CVSS 5.5, AV:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability impact. Every current Windows client and server branch is affected - Windows 10 1607/1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012 through 2025 including Server Core - so the exposure is broad even though the flaw cannot be used for remote initial access. No public exploit identified at time of analysis: CISA SSVC records Exploitation: none and Automatable: no, CISA KEV does not list this CVE, and no EPSS signal was provided; urgency is driven by patch hygiene rather than active threat activity. Microsoft has released fixes (see the MSRC update guide referenced below).
Information disclosure in the Windows Secure Kernel Mode component lets a locally authenticated attacker with low privileges read sensitive system information that should remain isolated inside the hypervisor-protected secure kernel, affecting Windows 10, Windows 11 and Windows Server 2016 through 2025 builds that predate Microsoft's fixed versions. Exploitation is constrained by high attack complexity and state-dependent conditions (CVSS AC:H, PR:L, AV:L), and there is no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none, the attack as non-automatable, and technical impact as partial. Microsoft has released patches, so this is a moderate-priority hardening item rather than an emergency response.
Heap-based buffer overflow in the Windows Storage Port Driver (CWE-122) lets an attacker who can physically interact with a target machine corrupt kernel pool memory and elevate privileges, with high impact to confidentiality, integrity, and availability (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 6.8). Unpatched Windows 11 builds (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025, including Server Core installations, are affected; no authentication or user interaction is required, but the attack depends absolutely on hands-on physical access, is not remotely reachable, and cannot be automated (SSVC Automatable=no, Exploitation=none). No public exploit identified at time of analysis, no confirmed active exploitation (not listed in CISA KEV), and a vendor patch is available.
Information disclosure in the Windows USB Print Driver allows a locally authenticated, low-privilege attacker to read beyond intended buffer boundaries and leak contents of driver memory on affected Windows 10, Windows 11, and Windows Server builds (2012 through 2025, including Server Core installations). Exploitation requires an existing foothold on the host with the ability to exercise the USB print driver code path (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), needs no victim interaction, and is limited to confidentiality impact - no data modification, no denial of service, and no remote vector. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' with partial technical impact, and an EUVD record (EUVD-2026-99784) tracks the same affected build list; vendor patches are available, making this a genuine but lower-tier patching priority compared with remotely reachable issues.
Out-of-bounds read in Windows Imaging Component (WIC) allows a locally authenticated attacker to disclose in-process memory contents when WIC processes a crafted or attacker-influenced image, with a CVSS of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Affected systems include a broad set of supported Windows 10, Windows 11, and Windows Server builds below their patched build thresholds, and exploitation requires prior low-privileged access to the host rather than remote network reachability. No public exploit identified at time of analysis, CISA SSVC reports exploitation none and automatable no, and Microsoft has released vendor updates to address the flaw.
Local tampering with Windows Security Account Manager (SAM) data is possible on unpatched Windows hosts because a critical SAM function performs no authentication or authorization check, letting an authenticated local user modify integrity-sensitive account information. Exploitation requires a pre-existing local session (AV:L, PR:L) and affects only integrity (C:N/A:N), so the practical impact is moderate rather than catastrophic, and no public exploit identified at time of analysis - SSVC rates exploitation as none and automatable as no. The flaw spans Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2022/2025 (including Server Core), all of which have vendor fixes available.
Information disclosure in Microsoft's Windows Projected File System (ProjFS) component allows an authenticated local user to read files or directories that should not be accessible to them, exposing content that the access-control model intended to keep restricted. Exploitation requires the attacker to already hold a local account on the target machine (CVSS PR:L, AV:L) and does not require user interaction, and per CISA's SSVC assessment it is neither actively exploited nor automatable. Affected builds span Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2019/2022/2025 including Server Core installations; no public exploit code has been identified and Microsoft has published fixes in its monthly cumulative updates, so real-world urgency is low and remediation is a routine patch cycle.
Local tampering with Windows Modern Device Management (MDM) is possible for an authenticated low-privileged attacker on affected Windows builds, allowing modification of MDM-related state or policy with high integrity impact but no confidentiality or availability impact. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms local access, low complexity, low privileges, no user interaction, and a medium 5.5 score; SSVC rates exploitation as none and non-automatable, and no public exploit has been identified at time of analysis. Vendor patches are available per Microsoft advisory, and affected platforms include Windows 10, Windows 11, and Windows Server releases listed in the Microsoft update guide.
Local authenticated attackers holding only low-level user privileges on a Windows host can cause the Device Association Service to misinterpret a resource's type (CWE-843 type confusion) and thereby leak sensitive information from the affected system. The flaw carries a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning it cannot be triggered remotely or by an unauthenticated user and does not by itself yield code execution, tampering, or denial of service, and there is no public exploit identified at time of analysis. Microsoft has shipped vendor fixes, and CISA's SSVC assessment records exploitation as none and the issue as non-automatable, so this is a moderate-priority patching and hardening item rather than an urgent, actively exploited threat.
Information disclosure in the Windows Win32 Kernel Subsystem stems from a time-of-check time-of-use (TOCTOU) race condition (CWE-367) that lets a local attacker with existing low-privileged code execution leak kernel memory contents. The issue rates only CVSS 4.7 (AV:L/AC:H/PR:L/UI:N, C:H/I:N/A:N) because seizing the narrow check-to-use window is difficult and non-deterministic; CISA's SSVC assessment scores Exploitation as 'none' and Automatable as 'no', and no public exploit code has been identified at time of analysis. Every in-support Windows 10, Windows 11 (21H2 through 26H2) and Windows Server 2012 through 2025 build below its respective patched build number is affected, and Microsoft has published fixes via its update guide.
Information disclosure in Windows Management Instrumentation (WMI) allows an authenticated local attacker to read past the end of an intended buffer, potentially exposing sensitive data held in the memory of the WMI service. The flaw affects a wide span of Windows builds - Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2, including 26H1), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - and requires the attacker to already hold a low-privileged local session on the host (CVSS 3.1 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Impact is confidentiality-only: no data modification, no denial of service, and no remote or unauthenticated path is indicated by the assessed vector. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as none and automatable as no, and Microsoft has released fixed builds for the affected branches.
Local information disclosure in Windows Modern Device Management (MDM) lets an authenticated, low-privileged attacker who already holds a foothold on the host read residual memory contents returned by the MDM subsystem. Rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), this is a local-only, low-complexity, no-user-interaction bug whose sole impact is confidentiality loss - there is no integrity or availability effect and no scope change. Vendor patches are available and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records exploitation as none, automatable as no, and technical impact as partial, which places this in the moderate-priority patch cycle rather than the emergency one.
Information disclosure in Windows Kernel-Mode Drivers on Windows 11 version 26H1 (builds 10.0.28000.0 and later, up to but not including 10.0.28000.3231) lets an authorized attacker who already holds a local low-privilege session read uninitialized kernel memory through a driver interface. The exposure is confined to confidentiality (C:H/I:N/A:N) with no code execution or modification primitive, and the attacker must already be logged on locally, so the issue is a moderate-severity leak rather than a privilege-escalation or remote attack path. There is no public exploit identified at time of analysis, the CISA SSVC assessment records exploitation as none and automatable as no, and Microsoft has published a fix in its update guide.
An out-of-bounds read in the WebDAV functionality of Microsoft Windows allows a locally authenticated, low-privileged attacker to read memory contents and disclose information; exploitation requires existing local access to the host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5), with no user interaction and low complexity. Affected systems span Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025, including Server Core installations, per the EUVD-listed build ranges. There is no CISA KEV entry and no public exploit identified at time of analysis (SSVC: Exploitation none, Automatable no), so this is a moderate, not urgent, priority best characterized as a post-compromise or malicious-insider information-disclosure aid rather than an initial-access vector.
An out-of-bounds read in the Remote Desktop Display Driver component of Microsoft Windows lets an authenticated, low-privileged local attacker disclose potentially sensitive memory contents on the affected host. Exploitation requires the attacker to already hold a local foothold on the machine (AV:L, PR:L) and to execute code that reaches the driver; no user interaction is needed (UI:N), and the impact is limited to confidentiality (C:H, I:N, A:N) with no code execution or system compromise by itself. No public exploit code has been identified at time of analysis, the flaw is not in CISA KEV, and CISA's SSVC framework rates it non-automatable with only partial technical impact, so real-world urgency is LOW despite the high confidentiality rating.
Improper access control in the Windows Routing and Remote Access Service (RRAS) allows an authenticated local attacker holding only low-level privileges to tamper with service state or configuration on affected Windows 10, Windows 11, and Windows Server builds. Exploitation is strictly local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), requires the optional RRAS role to be installed and enabled, and impacts integrity only - confidentiality and availability are unaffected, which is consistent with the moderate 5.5 base score. There is no public exploit identified at time of analysis and no evidence of confirmed active exploitation (CISA KEV), and vendor-released patches are available for every affected build branch.
Missing authorization in the Windows Overlay Filter (WOF) allows an authenticated local attacker to tamper with protected file/overlay data on affected Windows 10, Windows 11, and Windows Server 2016-2025 systems, producing an integrity-only impact (CVSS 5.5, CWE-862). The assessed vector (AV:L/PR:L/UI:N, C:N/I:H/A:N) means exploitation is neither remote nor unauthenticated: an attacker must already hold low-privileged local execution on the host, which confines real-world exposure to post-compromise and malicious-insider scenarios rather than a pre-auth or network attack. CISA SSVC records exploitation as "none" and no public exploit code has been identified at time of analysis; vendor patches are available from Microsoft, and this is a moderate-severity, low-urgency issue rather than an emergency.
An out-of-bounds read in the Windows Audio Service (Audiosrv) allows an attacker who already holds authenticated local access with low-level privileges to disclose memory contents from the affected host. The flaw is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning it is strictly a local, post-compromise information-disclosure issue - there is no remote vector, no integrity or availability impact, and no code execution. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records no exploitation activity and marks the issue as not automatable, so this is a genuine but low-urgency issue that should be handled through routine patching rather than emergency response.
Local tampering of network list data in the Windows Network List Service allows an authenticated low-privileged attacker to modify network profiles and settings, resulting in partial integrity impact while confidentiality and availability remain unaffected. Affected versions span Windows 10, Windows 11, and numerous Windows Server releases, with vendor patches available. No public exploit identified at time of analysis, and given the required local access and lack of remote vector, the risk is assessed as a moderate, low-priority integrity issue.
Uncontrolled resource consumption in the Windows RPC Endpoint Mapper service (listening on TCP 135) allows an unauthenticated, remote attacker to deny service over a network by exhausting service resources. Rated CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), the impact is availability-only and the High attack complexity means an outage is not achievable with a single trigger against default configurations, but requires sustained or precisely timed request volume. The affected surface spans Windows Server 2012 through Server 2025 (including Server Core) plus Windows 10 1607/1809/21H2/22H2 and Windows 11 23H2 through 26H2; no public exploit code and no confirmed active exploitation have been identified at time of analysis, and Microsoft has published a vendor update guide.
Information disclosure in Windows Kernel-Mode Drivers lets an authenticated local attacker read uninitialized kernel memory and leak residual kernel data on affected Windows 10, Windows 11, and Windows Server builds (Windows Server 2012 R2 through 2025). Exploitation requires a pre-existing standard local account and the ability to invoke the vulnerable driver code path; it is not remotely triggerable, needs no user interaction, and provides no code execution or system modification, so realistic value is as a kernel-memory-leak primitive inside a larger exploit chain. No public exploit code or confirmed active exploitation has been identified at time of analysis, and CISA SSVC rates the issue non-automatable, consistent with its low-to-moderate priority despite the CVSS 5.5 Medium score.
Local integrity tampering in the Windows Update Stack allows an authenticated low-privilege attacker who already holds a session on an affected Windows host to modify update-related configuration or state that should be protected, producing a high integrity impact with no confidentiality or availability effect. The flaw (CWE-15, external control of a system or configuration setting) touches a broad set of Windows 10, Windows 11, and Windows Server branches from 1809/21H2 through 26H1/26H2 and Server 2019/2022/2025. Vendor patches are available, no public exploit code or active exploitation has been identified, and CISA's SSVC assessment records exploitation as none with the issue rated non-automatable, so real-world risk is largely confined to insiders or post-compromise tampering rather than scalable remote attacks.
Information disclosure in Windows Health and Optimized Experiences Service on Windows 11 allows a locally authenticated low-privileged attacker to read sensitive data from the service because a critical function lacks proper authentication (CWE-306). The issue is local-only, requires an existing low-privileged session, and has low attack complexity but no user interaction; it does not permit privilege escalation or modification, and no public exploit has been identified at time of analysis. Microsoft has released a vendor patch, and this is a moderate, low-priority issue rather than an urgent threat.
Information disclosure in the Windows Event Log service allows an authenticated local attacker to read potentially sensitive memory contents. Affecting a broad range of Windows 10, 11, and Server editions, this low-severity flaw requires prior local access and only results in confidentiality impact, with no code execution or privilege escalation. No public exploit identified at time of analysis, and Microsoft has released patches.
An out-of-bounds read in the Microsoft Windows Storage Port Driver (CWE-125) lets an attacker who already has physical access to a device read past the end of a buffer and disclose kernel memory contents to an unauthorized party. Every supported Windows client and server build from Windows 10 1607 and Windows Server 2012 through Windows 11 26H2 and Windows Server 2025 is affected, as tracked in EUVD-2026-100340, and because the vector is AV:P the flaw cannot be reached remotely - it is confined to lost, stolen, or unattended hardware and evil-maid style scenarios. Microsoft has released a vendor patch, there is no public exploit identified at time of analysis, and CISA's SSVC decision framework rates exploitation as none and the issue as non-automatable, making this a genuinely low-priority item despite the CVSS confidentiality rating of High.
Improper authorization in the Windows Encrypting File System (EFS) lets an already-logged-in local user tamper with protected data that they should not be permitted to modify, yielding a high integrity impact with no confidentiality or availability impact (CVSS 5.5, AV:L/PR:L/UI:N, C:N/I:H/A:N). Only Windows 10, Windows 11, and Windows Server hosts that have not yet applied the current cumulative updates are exposed; the attack is strictly local, requires an interactive session and at least low-level privileges, and there is no public exploit identified at time of analysis (no CISA KEV entry, SSVC exploitation: none, EPSS not notable). This is a genuinely moderate, low-urgency issue rather than a high-priority emergency: vendor patches already exist for every affected build, so exposure is limited to unpatched systems where a low-privileged local user could subvert EFS authorization checks.
An out-of-bounds read (CWE-125) in Microsoft Digest Authentication on unpatched Windows client and server builds lets an authenticated local user disclose information from the host; the CVSS 3.1 vector (AV:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms the attacker must already hold low-level privileges on the machine, needs no user interaction, and can only read data - with no impact on integrity or availability. Because reachability is local rather than remote, the component is the Windows Digest/SASL authentication provider itself, and exploitation is limited to memory disclosure on systems that have not yet installed the vendor fixes identified by EUVD build numbers. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and SSVC assesses the issue as not automatable with no observed exploitation, so it should be treated as a low-to-moderate-priority hardening item rather than an emergency.
An out-of-bounds read in the Windows Key Storage Provider (KSP) allows an authenticated, low-privileged local user to disclose memory contents from the calling process, as rated CVSS 3.1 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only systems running Windows builds below the fixed levels published in the Microsoft update guide and EUVD (for example, Windows 11 24H2 below 10.0.26100.9711 or Windows Server 2025 below 10.0.26100.33650) are affected; patched builds are not exploitable. The issue requires an existing local session and valid credentials, is not remotely reachable, and there is no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, making this a moderate-severity, low-priority issue in practice.
Information disclosure in the Windows WebDAV component lets an authenticated, low-privileged attacker read files or directories that should not be exposed over the network (CWE-552), rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, high confidentiality impact, no integrity or availability impact). The flaw affects a broad set of unpatched Windows client and server SKUs - Windows 10, Windows 11, and Windows Server 2012 through 2025 - wherever WebDAV is present and network-reachable. Exploitation is not remote-unauthenticated: it requires a valid low-privilege account plus WebDAV exposure, CISA's SSVC rates exploitation as not observed, non-automatable and only partial technical impact, and no public exploit code has been identified at time of analysis. Vendor patches are available.
Missing authorization checks in the Windows WebDAV component allow an attacker who already holds valid low-privilege credentials to bypass a security feature over the network, affecting only integrity (no confidentiality or availability impact). Microsoft rates this CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), meaning exploitation is straightforward once an authenticated foothold exists but does not permit data theft or denial of service. Vendor fixes are available; at time of analysis there was no public exploit code and no confirmed active exploitation (not in CISA KEV).
Tampering of Windows Host Guardian Service (HGS) configuration and attestation-related data is possible for an authenticated local attacker on hosts where the HGS role is deployed, yielding high integrity impact with no loss of confidentiality or availability. Rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) under CWE-250, this is a moderate-severity, low-priority issue rather than an urgent threat: Microsoft has released patched builds, no public exploit code has been identified at time of analysis, and CISA's SSVC decision framework records Exploitation: none and Automatable: no. Exposure is narrow, confined to guarded-fabric/shielded-VM environments where the HGS server role is installed rather than to general Windows installations.
An out-of-bounds read in the Windows Remote Access Service Infrastructure lets an attacker who already holds a low-privilege local session on the host read beyond the bounds of an allocated buffer and disclose information from process memory. Exploitation requires both local access (AV:L) and an authenticated low-privilege context (PR:L) per the assessed CVSS vector, with no network-facing or unauthenticated path, and CISA's SSVC assessment marks it non-automatable with only partial technical impact, so this is a moderate-severity disclosure issue rather than a top-tier emergency. No public exploit code has been identified at time of analysis, though the affected component ships across an unusually broad footprint: Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025, including Server Core installations.
A security-feature bypass in the Windows Kernel (CVE-2026-85939, CVSS 5.3) lets an authenticated attacker with only low-level privileges (PR:L per the CVSS vector) reach and subvert a kernel security control over the network, with the outcome limited to integrity impact - no loss of confidentiality or availability. Exploitation is not deterministic: the high attack-complexity rating (AC:H) indicates success depends on conditions outside the attacker's direct control, such as a race or timing window or a specific runtime state, and the affected kernel feature is not named in the available description. A vendor patch is available, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; the risk is moderate and best addressed through prompt cumulative-update deployment across all supported Windows client and server branches listed in the advisory.
Information disclosure in the Windows Broadcast DVR User Service (BcastDVRUserService) allows an attacker with local access and low-level authenticated privileges to read information they are not authorized to see on affected Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2019 hosts. Tracked as CWE-862 (missing authorization) with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the flaw is not remotely reachable and requires an existing foothold on the target machine, with confidentiality the only impacted property and no effect on integrity or availability. No public exploit code has been identified at time of analysis, and the CISA SSVC assessment records exploitation as 'none' and automatable as 'no', making this a moderate, low-priority issue despite affecting a ubiquitous platform; vendor patches are available.
A local information-disclosure flaw in the Windows USB Driver component allows an attacker who already holds authenticated low-privilege access on a Windows host to read past the end of a kernel buffer and leak memory contents back to the caller. Because the CVSS vector is AV:L/PR:L/UI:N, exploitation requires a pre-existing local foothold and direct interaction with the driver on the affected machine; there is no network-reachable attack path and no user interaction is needed once that access exists. Impact is limited to confidentiality (C:H) with no integrity or availability effect, making this an information-leak primitive (useful for defeating ASLR or extracting pointer data) rather than a direct path to code execution, and there is currently no public exploit identified at time of analysis and no CISA KEV listing.
Local information disclosure in Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025 lets anyone who already holds a local user session read private personal information they should not be able to access, yielding a HIGH confidentiality impact (CVSS 6.2, CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability effect. The flaw is not remotely reachable and requires no authentication or user interaction beyond the local foothold, so the practical exposure is limited to hosts where an attacker has already gained local code execution on an unpatched build. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC reports Exploitation: none, Automatable: no), and the moderate score plus the local-only vector point to LOW real-world urgency even though the data disclosed is sensitive.
Information disclosure in the Windows StateRepository API permits a locally authenticated low-privileged attacker to read beyond allocated buffers and disclose memory contents on Windows 11 and Windows Server 2025. The flaw requires local code execution with a valid account (PR:L/AV:L) and no user interaction; remote or unauthenticated attackers cannot trigger it directly. No public exploit code or active exploitation is known (CISA SSVC: none), and Microsoft has released patches for all affected builds.
Local information disclosure in the Windows Universal Disk Format File System (UDFS) driver allows an authenticated local attacker to leak memory contents by supplying a crafted UDF-formatted volume - such as a malicious ISO disc image, UDF-formatted removable media, or a mountable disk image - for the driver to parse. Successful exploitation is limited to confidentiality impact (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5), with no code execution, persistence, or denial of service; CWE-822 points to improper handling of an untrusted pointer/offset during parsing. There is no public exploit identified at time of analysis, CISA's SSVC assessment rates the issue as non-automatable with partial technical impact, and vendor-released patches are available, so this is a moderate-severity, low-urgency issue across supported Windows client and server releases.
Information disclosure in the Windows ALPC (Advanced Local Procedure Call) subsystem allows a locally authenticated, low-privileged attacker to read sensitive system information that should not be reachable from their privilege level. The flaw carries a CVSS v3.1 base score of 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning exploitation requires an existing interactive session on the host plus a non-trivial race or state precondition, and yields confidentiality impact only - no integrity or availability effect. Affected builds span Windows 10 21H2/22H2/1809, Windows 11 23H2 through 26H2, and Windows Server 2019/2022/2025; a vendor patch is available through the Microsoft Update Guide, and there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).
Denial of service in Microsoft Windows Message Queuing (MSMQ) Queue Manager allows an authenticated, low-privileged remote attacker to crash the service by triggering a null pointer dereference, rendering the queuing service unavailable to legitimate applications on the affected host. Exploitation is constrained: MSMQ is an optional, non-default Windows component that must be installed, running, and network-reachable (typically TCP 1801), and the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms credentials are required while no user interaction is needed. Impact is purely availability (A:H with C:N/I:N) - no data exposure or modification - and there is no public exploit identified at time of analysis (CISA SSVC exploitation: none); vendor patches are available for all affected Windows client and server branches.
Information disclosure in Windows Kernel-Mode Drivers lets a locally authenticated user with only low-level privileges read sensitive information that the driver writes into its log files, affecting a broad range of Windows client and server releases from Windows Server 2012 through Windows 11 26H2 and Windows Server 2025. The flaw is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so it is strictly local, requires prior authentication, needs no victim interaction, and causes only confidentiality loss on a host the attacker has already accessed. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as none and the issue is not automatable, and Microsoft has released patched builds for all affected editions, making real-world urgency low despite the high confidentiality sub-score.
Information disclosure in Windows Management Instrumentation (WMI) allows an attacker who already holds a local, low-privileged foothold on a Windows host to read memory contents that should not be exposed to them. The flaw is an out-of-bounds read (CWE-125) triggered through a locally reachable WMI code path; no user interaction is required and attack complexity is low once local access exists, but the vector is strictly local and authenticated (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5), with impact limited to confidentiality - no code execution, integrity modification, or denial of service. There is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as 'none'; vendor patches are available and fully updated Windows 10, Windows 11, and Windows Server builds are not exposed.
An out-of-bounds read in the Windows Print Spooler lets an unauthenticated remote attacker disclose memory contents over the network, but only if a victim is first induced to interact with an attacker-controlled print resource or crafted spooler response. Microsoft rates this 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), so impact is confined to confidentiality - there is no code execution, data modification, or denial of service. All supported Windows client and server builds are affected, including Server Core installations, yet no public exploit has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', which keeps real-world priority low-to-moderate; vendor patches are available and should be applied through normal patch cycles.
Information disclosure in the Windows Event Viewer allows an authenticated attacker with low-level authorization (CVSS PR:L) to reach the component over the network (AV:N) and read files or directories that should not be exposed, resulting in high confidentiality impact with no integrity or availability effect. The flaw, tracked as CVE-2026-85840 and rooted in CWE-552, is rated 6.5 and affects a very broad set of Windows client and server builds, including Windows 10, Windows 11 (21H2 through 26H2) and Windows Server 2012 through 2025. CISA's SSVC assessment records no observed exploitation and no automatable attack path, and no public exploit code has been identified at time of analysis; vendor patches are available, so exposure is concentrated on unpatched, multi-user or shared-access hosts such as RDS/terminal servers and jump boxes where many low-privileged accounts coexist.
Information disclosure in the Windows Biometric Service (WbioSrvc) allows a locally authenticated attacker with low privileges to trigger a heap-based buffer overflow and over-read heap memory handled by the service, potentially exposing sensitive data. The flaw affects Windows 10, Windows 11, and Windows Server builds tracked as EUVD-2026-99540 and requires an existing local foothold, with no network vector and no victim interaction; the assessed impact is confined to confidentiality loss with no code execution, integrity, or availability effect. Microsoft has released patches, CISA's SSVC assessment records exploitation as 'none' and automation as 'no', and no public exploit has been identified at time of analysis, making this a moderate-severity, low-urgency fix rather than an emergency.
Out-of-bounds read in the Microsoft Windows Installer component allows an authenticated attacker with low-level local privileges to read memory contents outside intended bounds and disclose information from the affected host. The flaw affects a broad set of Windows client and server builds, including Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1/26H2), Windows Server 2012 through 2025, and their Server Core installations; exploitation requires a pre-existing local foothold, as the assessed vector is AV:L/PR:L with no remote or unauthenticated path, and impact is confined to confidentiality (C:H/I:N/A:N) with no code execution or availability effect. There is no public exploit identified at time of analysis, CISA's SSVC evaluation rates exploitation as none and non-automatable, and the vendor has released fixes, so this is a moderate-severity local disclosure issue rather than an urgent remote threat.
Information disclosure in the Windows Universal Disk Format (UDFS) file-system driver lets an authenticated local attacker read memory beyond the bounds of an allocated buffer by presenting a crafted UDF volume - typically a rigged ISO image, optical disc, or virtual/removable disk - for the kernel driver to mount and parse. The flaw is an out-of-bounds read (CWE-125) rated 6.5 MEDIUM; although the supplied CVSS vector advertises network reachability (AV:N), the file-system parsing path and the description's 'locally' wording indicate that local, authenticated access is required, so defenders should treat the vector as AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. Impact is bounded to confidentiality with no code execution or data tampering, no public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and the attack as non-automatable, and vendor patches are available - together these signals keep real-world urgency moderate-to-low despite the MEDIUM score.
Out-of-bounds read in the Windows Wi-Fi Driver (CWE-125) allows an attacker who already sits on the same wireless network or local Layer-2/broadcast segment as the target - and who already holds low-level privileges on that adjacent segment - to read beyond the bounds of a kernel buffer and disclose information from the affected Windows system. The issue affects a broad range of supported builds, from Windows 10 1607 through Windows 11 26H2 and the corresponding Windows Server 2016/2019/2022/2025 releases, all of which are fixed by the current cumulative updates. Impact is limited to confidentiality (CVSS:3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.7); there is no integrity or availability impact, no code execution or privilege escalation, no public exploit code identified at time of analysis, and CISA's SSVC rates exploitation as none and automatable as no, making this a moderate, patch-routinely item rather than an emergency.
An out-of-bounds read (CWE-125) in the Windows Device Association Service lets an authenticated, low-privileged local user read memory past the end of an allocated buffer and disclose its contents, producing a high confidentiality impact with no integrity or availability effect (CVSS 5.5, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The affected surface covers Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations, but exploitation requires an existing local account/session on the host because there is no network-facing vector and no user interaction is needed. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as none and the flaw as not automatable, and patch availability from Microsoft makes this a moderate, low-urgency remediation item rather than an emergency one.
Local information disclosure in the Windows Bind Filter (bindflt.sys) driver allows an authenticated local attacker with low privileges to read files outside their intended boundary on unpatched Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 systems. The flaw is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and is a CWE-552 improperly-restricted file/directory access issue in the kernel-mode driver that underpins filesystem bind/redirection mounts. Vendor-released patches are available with fixed builds listed in the EUVD ranges, and no public exploit identified at time of analysis; the SSVC assessment shows exploitation none and not automatable, so risk is moderate and limited to hosts where an attacker already holds a local, authenticated foothold.
Security feature bypass in Windows PowerShell allows an unauthenticated attacker to defeat a security check, but the victim must actively run or open attacker-supplied content (UI:R), so it is not a hands-off remote exploit. Impact is integrity-only (C:N/I:H/A:N, CVSS 6.5); Microsoft has released patches, CISA SSVC rates exploitation as none and automatable as no, and no public exploit code was identified at time of analysis.
An out-of-bounds read in the Windows Routing and Remote Access Service (RRAS) allows an attacker who already holds valid credentials for a low-privileged local account to read memory beyond the bounds of an allocated buffer and disclose information from the affected host; no user interaction is required. The exposure is narrowed considerably by two prerequisites: RRAS is a non-default role that must be installed and running, and exploitation requires local access plus low-privileged authentication, so there is no remote or unauthenticated path. Impact is confidentiality-only (high) with no integrity or availability effect, and no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and the activity as not automatable, making this a moderate, low-urgency issue rather than a top patching priority.
Local information disclosure in the Windows Sysmain service allows an authenticated attacker with low-level local privileges to access sensitive system information on unpatched Windows 10, Windows 11, and Windows Server builds. Exploitation requires existing local access and valid credentials (CVSS PR:L), with no user interaction needed, and is limited to confidentiality impact; no public exploit identified at time of analysis, and CISA SSVC records no exploitation. Microsoft has released vendor patches for the affected builds via its MSRC advisory.
Use-after-free in the Microsoft QUIC (MsQuic) Schannel native library allows an unauthenticated, remote attacker who can reach a QUIC/HTTP-3 endpoint to disclose memory contents over the network, with impact limited to confidentiality (no integrity or availability effect). Affected software includes .NET applications referencing the Microsoft.Native.Quic.MsQuic.Schannel package in versions 1.9.0 through 2.6.1, plus a broad set of Windows 11 and Windows Server 2022/2025 builds and Visual Studio 2022/2026 that ship the vulnerable QUIC binaries. Exploitation is non-deterministic because the CVSS vector (AC:H) reflects a race condition the attacker must win, and no public exploit code has been identified at time of analysis; the CISA SSVC assessment records exploitation as none and the issue as not automatable, making this a genuine-but-moderate risk rather than a fire-drill.
An out-of-bounds read in Windows Installer allows an authenticated, low-privileged local user to disclose information from the affected host, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation requires the attacker to already hold a low-privileged local account and the ability to have Windows Installer (msiexec) process a crafted MSI package on that machine; the vulnerability cannot be triggered remotely or by an unauthenticated user, and no victim interaction is required. Impact is bounded to confidentiality - there is no code execution or privilege escalation from this flaw alone, CISA SSVC records exploitation as none, and no public exploit has been identified at time of analysis; a vendor patch is available.
An out-of-bounds read in the Windows Remote Desktop Client lets a malicious or compromised RDP server leak process memory, giving an unauthenticated attacker a network-based information disclosure path against any Windows host whose user connects to that server. The flaw is strictly client-side: the victim must initiate an outbound RDP session (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5), which is the main limiting factor, while confidentiality impact is rated High and no authentication, integrity, or availability impact is involved. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as "none" and automatable as "no", and Microsoft has published remediation through its Security Update Guide, making this a moderate-priority issue rather than a top-tier emergency.
Out-of-bounds memory read in the Windows Device Association Service (DAS) allows a locally authenticated, low-privileged user on Windows 10, Windows 11 and Windows Server 2012 through 2025 to make the service return data past the end of an allocated buffer, disclosing memory contents. The vector (AV:L/PR:L/UI:N, C:H/I:N/A:N) confirms the attacker must already be able to execute code locally and needs no victim interaction, and no public exploit code has been identified at time of analysis; CISA's SSVC rates exploitation as 'none' with partial technical impact and non-automatable, so this is best characterised as a secondary primitive (for example an ASLR or memory-layout bypass) rather than a standalone compromise path. Microsoft has released vendor patches, and because DAS ships enabled by default on all supported Windows editions, every unpatched host in the listed build ranges carries the exposure.
Information disclosure in the Windows Device Association Service (DAS) lets an attacker who already holds valid low-privileged credentials on a target host read portions of the service's memory over the network, exposing potentially sensitive data. The flaw affects default installations of Windows 10, Windows 11 (23H2 through 26H2/26H1), Windows Server 2012 R2, 2016, 2019, 2022, and 2025 below their respective patched builds, and carries a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning confidentiality-only impact with no code execution, modification, or denial of service. Microsoft has released fixes and CISA's SSVC evaluation records no exploitation and no automatable exploitation at time of analysis, with no public exploit identified; the PR:L authentication prerequisite and read-only outcome materially reduce real-world urgency.
Information disclosure in the Windows Print Spooler on affected client and server editions lets an authenticated local user obtain uninitialized memory contents from spooler components, potentially exposing residual sensitive data held by a privileged process. The flaw is rated 5.5 (CVSS:3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning exploitation is strictly local, requires a valid low-privileged account with local code execution or session access, needs no user interaction, and cannot be triggered remotely or by an unauthenticated attacker. Exploitation against CVE-2026-85320 is not currently observed, no public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none, so exposure is concentrated in shared multi-user hosts such as RDP servers, terminal servers and jump boxes; Microsoft has released patches.
Improper authorization logic in the Windows SMB Client lets an authenticated local user bypass a Windows security feature, yielding a high-integrity impact on the affected system (CVE-2026-84011, CVSS 5.5). Exploitation requires an attacker to already hold valid low-privileged credentials and local code execution on the host (CVSS vector AV:L/PR:L/UI:N), so this is a post-compromise privilege-context escalation rather than a remotely reachable flaw; no confidentiality or availability impact is assessed. There is no public exploit identified at time of analysis and CISA SSVC rates exploitation as "none" with the issue considered non-automatable; Microsoft has released fixed builds for all affected Windows 11 and Windows Server 2022/2025 editions.
Local tampering in the Windows Projected File System (ProjFS) component allows an authenticated, low-privileged attacker who already holds a foothold on the machine to win a time-of-check time-of-use race and alter data the component is handling. The flaw is scored CVSS v3.1 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N) - it is not remotely reachable, requires local authenticated access, and is gated by high attack complexity, so success depends on repeatedly hitting a narrow race window rather than a single deterministic action, with the only impact being a high integrity/tampering effect and no confidentiality or availability loss. No public exploit has been identified at time of analysis - there is no CISA KEV listing, and CISA's SSVC assessment rates exploitation as 'none' and the issue as not automatable - while Microsoft has published a fix, making this a low-to-moderate priority patching item rather than an emergency.
Improper link resolution in the Windows Update Orchestrator Service allows a locally authenticated, low-privileged attacker to read files they would not otherwise be permitted to access on Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2022/2025. Because the service runs as SYSTEM and dereferences filesystem paths without validating reparse points, an attacker who already holds a foothold can plant a symbolic link, junction or hard link and race the service into opening a protected file, yielding high-confidentiality information disclosure with no integrity or availability impact (CVSS 5.5). Exploitation is assessed as non-automatable under CISA's SSVC framework, no public exploit code has been identified at time of analysis, and overall risk is comparatively low-priority given the local, post-compromise prerequisites.
Improper certificate validation in Windows Hello lets an attacker who already holds high local privileges on an affected Windows host bypass the feature's certificate-based authentication check, exposing credential material that Windows Hello would otherwise protect (confidentiality impact only). The defect is strictly local - there is no network attack path and no user interaction is required - and it affects Windows 10, Windows 11 and Windows Server builds below their respective patched levels, including Windows 11 24H2 (below 10.0.26100.9711) and Windows Server 2025 (below 10.0.26100.33650). Exploitation has not been observed: CISA's SSVC assessment records exploitation status 'none' and automatable 'no', and no public exploit code has been identified at time of analysis, making this a moderate-severity issue best handled by routine patching rather than emergency response.
Information disclosure in the Windows Win32 kernel subsystem allows an authenticated local attacker holding low-level privileges to read sensitive system data that should be confined to a more privileged control sphere. Unpatched Windows 10, Windows 11 and Windows Server builds are affected, and triggering the flaw requires local interactive or code-execution access plus a hard-to-control precondition, which is why the vendor scores it only 4.7 (AV:L/AC:H/PR:L/UI:N, C:H/I:N/A:N - confidentiality impact only, no integrity or availability loss). No public exploit was identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and the issue as not automatable, and vendor-released patches are available from Microsoft.
Local information disclosure in Microsoft Windows Hello allows an attacker who already holds low-privileged authenticated access on a Windows 10 or Windows 11 host to read sensitive system data that should be outside their control sphere. Exploitation requires local interactive access (AV:L, PR:L), involves no victim user interaction (UI:N), and yields only confidentiality impact - no code execution, tampering, or denial of service - which is why our assessment rates this a genuine but comparatively low-priority issue rather than an urgent one. There is no evidence of active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, SSVC rates it not automatable, and Microsoft has released fixed build floors for every affected branch.
Spoofing in Windows Shell allows unauthenticated remote attackers to impersonate trusted content by exploiting an incorrectly implemented authentication algorithm (CWE-303), requiring the victim to interact with attacker-supplied content (UI:R). Affects Windows 11 versions 23H2, 24H2, 25H2, 26H1, 26H2 and Windows Server 2025 (including Server Core installation) on builds prior to the patched versions, with high confidentiality impact but no integrity or availability loss. No public exploit identified at time of analysis (CISA SSVC: Exploitation none).
Information disclosure in the Windows Shell lets an attacker who already holds a valid low-privileged local account on a Windows host read sensitive system information that should fall outside that account's access sphere. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms this is not remotely reachable, requires an authenticated local logon, needs no user interaction, and is gated by high attack complexity such as a race condition or a specific system state the attacker must win, so reliability is limited; only confidentiality is affected. No public exploit code and no confirmed active exploitation have been identified at time of analysis (CISA SSVC records Exploitation: none, Automatable: no), and the patch is available from the vendor, making this a low-to-moderate priority issue despite the critical confidentiality rating.
An out-of-bounds read in the Windows HID Parser Library (hidparse.sys) allows an attacker who already holds low-privileged local access to read beyond the bounds of a buffer and disclose kernel memory contents to user space, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation is local only - the attacker must be authenticated on the host and must cause the parser to process a malformed HID report descriptor, typically by attaching or emulating a crafted USB or Bluetooth HID device - and the result is read-only information disclosure with no code execution or system modification. No public exploit has been identified at time of analysis, CISA SSVC records no observed exploitation and rates the issue non-automatable with partial technical impact, and a vendor patch is available from Microsoft (MSRC update guide, EUVD-2026-100040).
An out-of-bounds read in the Windows HID Parser Library lets an authenticated, low-privileged local attacker disclose information from the host by inducing the parser to process a malformed or attacker-influenced HID report or descriptor, yielding a CVSS v3.1 score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only confidentiality is affected - there is no integrity or availability impact - and because the vector requires PR:L and AV:L, an attacker must already hold a local authenticated session, making this a post-compromise or malicious-insider concern rather than a remotely reachable one. Vendor patches are available and no public exploit has been identified at time of analysis, and CISA's SSVC assessment records exploitation as none and automatable as no, reinforcing a moderate-severity, low-priority rating in practice.
Information disclosure in the Windows Win32 Kernel Subsystem allows an authenticated local user who can already execute code on the host to read sensitive system information that should remain outside their control. Exploitation is gated by a hard-to-satisfy, attacker-uncontrollable condition (CVSS AC:H), so the flaw is unreliable to trigger, and the impact is confidentiality-only with no integrity or availability loss. There is no CISA KEV listing and no public exploit identified at time of analysis, and Microsoft has shipped fixed builds for every affected Windows client and server branch, making this a genuinely low-priority, moderate-severity issue despite the ubiquity of the platform.
Privilege escalation in the Windows Win32 Kernel Subsystem stems from a heap-based buffer overflow (CWE-122) that an attacker with physical access to a target machine can trigger to gain SYSTEM-level privileges; once physical contact is achieved, no authentication or user interaction is required. Microsoft has released vendor patches, and no public exploit code or active exploitation has been identified at time of analysis (SSVC exploitation: none, automatable: no). Because the attack vector is physical (CVSS AV:P) with a 6.8 score, realistic risk is limited to insiders, shared or kiosk endpoints, and lost or stolen devices rather than remote attackers.
Local information disclosure in the Windows Clipboard User Service lets an authenticated attacker who already holds a low-privileged foothold on the host read sensitive system information the service is meant to keep segregated (CVSS 3.1 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only confidentiality is affected - integrity and availability are untouched - and exploitation requires valid local credentials, so it cannot be reached remotely or by an unauthenticated actor. Microsoft has published fixes for all supported Windows client and server branches; no public exploit code exists and there is no confirmed active exploitation (CISA SSVC exploitation: none, automatable: no, technical impact: partial), making this a moderate, low-priority hardening item.
Local information disclosure in the Windows HID Parser Library (CWE-125, out-of-bounds read) affects Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2019/2022/2025, allowing a low-privileged local actor to read memory beyond an intended buffer and potentially disclose sensitive data. Successful exploitation requires local, authenticated access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) plus the ability to get the parser to process attacker-influenced HID descriptor or report data, for example via an attached or emulated USB HID device; integrity and availability are unaffected. The issue is rated moderate rather than high priority: there is no public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and a vendor-released patch is available from Microsoft.
Out-of-bounds read in the Windows HID Parser Library lets an attacker who already holds authenticated local access to a Windows host read beyond the bounds of a parser buffer by supplying a crafted or emulated HID input (for example a malicious USB HID device or a malformed HID report descriptor), resulting in local information disclosure. The affected component is only reachable after local authentication and requires attacker-controlled HID traffic, and the outcome is limited to confidentiality loss (C:H) with no integrity or availability impact and no scope change, so this is a genuine but comparatively low-urgency issue. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as "none" and the issue as non-automatable, and vendor-released patches are available in the form of the Windows build updates listed below.
Spoofing of data protected by the Windows Virtualization-Based Security (VBS) Enclave is possible for a local attacker who already holds a low-privileged foothold on the machine, because the enclave relies on encryption of insufficient strength. Exploitation requires the VBS Enclave feature to be in use and is constrained by high attack complexity (AC:H) and non-automatable conditions per SSVC, and it yields integrity/spoofing impact only (I:H) with no confidentiality or availability loss. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation; severity is moderate (CVSS 5.6) and a vendor patch is available.
An out-of-bounds read in the Windows HID Parser Library lets a locally present, low-privileged authenticated attacker disclose information from the affected system's memory by supplying a malformed HID descriptor or report to the parser. The flaw is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) and yields confidentiality impact only - no code execution, no privilege escalation, and no integrity or availability effect - though leaked memory contents could assist follow-on attacks. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as 'none' and automatable as 'no', and Microsoft has published a patch; exploitation requires an existing local foothold plus the ability to feed crafted HID data (physical, emulated, or virtual HID device).
An out-of-bounds read in the Windows HID Parser Library allows an attacker who already holds a valid local session on an affected Windows host to disclose memory contents by supplying crafted or malformed HID descriptor data (for example via an emulated or malicious USB/Bluetooth HID device, or a local process feeding HID input). Exploitation requires local access and low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) and results in information disclosure only - no code execution, integrity, or availability impact - and no public exploit was identified at time of analysis, with CISA's SSVC rating exploitation as none and the flaw as non-automatable. Microsoft has released patched builds for all affected Windows 10, Windows 11, and Windows Server editions, so this is a moderate, not urgent, priority that is resolved by applying current cumulative updates.
Local information disclosure in the Windows Aggregated Data Platform Service allows an authenticated, low-privileged user on an affected Windows 11 host to read past the bounds of an in-memory buffer and potentially expose sensitive data that the account would not otherwise be entitled to see. Only unpatched Windows 11 builds - 24H2 below 10.0.26100.9711, 25H2 below 10.0.26200.9711, 26H2 below 10.0.26300.9711, and 26H1 below 10.0.28000.3231 - are affected; the CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (5.5) confirms the attacker must already hold a local account and that no integrity or availability impact is possible. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC: Exploitation none, Automatable no), and no EPSS score was supplied; the mandatory local foothold keeps this a moderate-severity, patch-cycle item rather than an emergency.
Local file tampering through a relative path traversal flaw in Windows WinINet (wininet.dll) requires an attacker to already hold authenticated, low-privileged access to the machine and to satisfy a high-complexity precondition, so it cannot be triggered remotely and carries no confidentiality or availability impact. All supported Windows client and server branches are affected - Windows 10 and 11 releases plus Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - up to the fixed build numbers published in Microsoft's update guide. No public exploit code has been identified, CISA's SSVC assessment records exploitation as 'none', and Microsoft rates the issue Medium (CVSS 4.7), making it a routine patch-cycle item rather than an emergency.
Heap-based buffer overflow in Windows DNS Server allows an authenticated, low-privilege attacker with network access to disclose sensitive information from server memory. The vulnerability affects numerous Windows Server and Windows 10/11 builds that have the DNS Server role installed, with no public exploit identified at time of analysis. Although rated CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, the confidentiality-only impact and requirement for authentication limit the realistic threat to information leakage rather than code execution or denial of service.
Heap memory disclosure in Microsoft Windows Hyper-V lets an authenticated, low-privileged principal - such as an account inside a guest VM or a low-rights user able to reach the Hyper-V service over the network - read leaked contents of the hypervisor's heap, affecting Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2019, 2022, and 2025 including Server Core installations. The flaw carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning no user interaction and low attack complexity are required, but the attacker must already hold valid credentials and the outcome is read-only: confidentiality is fully impacted while integrity and availability are untouched, so hosts without the Hyper-V role enabled are not exposed. No public exploit been identified at time of analysis, and Microsoft has published fixed builds via its MSRC update guide.
Local tampering in the Windows Container Isolation FS Filter Driver (unionfs.sys) lets an authenticated attacker redirect file operations to an attacker-chosen destination. A low-privileged user who can create or control a symbolic link, junction, or reparse point that unionfs.sys resolves during a file operation can exploit improper link resolution (CWE-59) to modify or overwrite files the driver handles, affecting Windows 11 24H2, 25H2, 26H1 and 26H2 plus Windows Server 2022 and 2025 builds prior to their patched levels. The flaw is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), meaning local authenticated access is a prerequisite and only integrity is impacted; no public exploit code has been identified and CISA's SSVC assessment records exploitation as none and automatable as no, so real-world urgency is low.
Local information disclosure in the Windows Client Side Caching driver (csc.sys) lets an authenticated attacker who already holds low-level privileges on a Windows host read sensitive data that should be restricted, such as contents of the Offline Files cache. The flaw affects default installations across Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, and requires only local access with no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5). There is no public exploit identified at time of analysis, CISA's SSVC rates exploitation as 'none' and the issue as non-automatable with partial technical impact, and Microsoft has released patched builds - making this a post-compromise disclosure primitive rather than a remote entry point.
Information disclosure in the Microsoft Windows Storage component lets an authenticated local attacker read sensitive data that the service places in a file or directory reachable by lower-privileged users (CWE-538). Exploitation requires a valid low-privileged interactive session on an unpatched host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), so it cannot be triggered remotely or by an unauthenticated user, and the impact is confidentiality-only (C:H, I:N, A:N) with a base score of 5.5. Microsoft has released fixes, CISA's SSVC assessment rates exploitation as 'none' with automatable 'no', and no public exploit code has been identified at time of analysis, making this a moderate-severity hardening item rather than an urgent remote threat.
Local privilege escalation in the Windows Distributed File System (DFS) lets an authenticated attacker with valid host credentials trigger a heap-based buffer overflow (CWE-122) and elevate to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. Exploitation is local only with no user interaction and, per Microsoft's advisory, requires existing high privileges, so realistic exposure is limited to shared, multi-user, or terminal-server hosts where an untrusted authenticated principal is present. No public exploit code has been identified at time of analysis and CISA's SSVC rates exploitation as none; vendor patches are available.
Information disclosure in the Windows NTFS file system driver allows an authenticated local attacker to read sensitive system information that should be restricted to a higher privilege level. The flaw affects Windows 10, Windows 11, and Windows Server installations on NTFS volumes below their respective patched builds; exploitation requires pre-existing local code execution or interactive access as a low-privileged user (CVSS PR:L), with no remote vector and no user interaction (UI:N). No public exploit code has been identified at time of analysis, and Microsoft has released vendor patches.
An out-of-bounds read in the Windows Universal Disk Format File System (UDFS) kernel-mode driver lets a locally authenticated attacker disclose information - potentially kernel memory contents - on an affected host. Exploitation requires existing local access and the ability to feed crafted UDF-formatted content (a mounted ISO/UDF image, removable USB media, or a virtual volume) to the driver; the vulnerability is not remotely reachable, cannot be triggered unauthenticated, and has no integrity or availability impact, which is why CISA's SSVC rates it non-exploited and non-automatable. Microsoft has shipped fixed builds for every affected Windows 10, Windows 11, and Windows Server release, and no public exploit code has been identified at time of analysis, making this a moderate-severity, low-priority issue despite affecting a kernel-mode component present by default on all listed platforms.
An out-of-bounds read in the Windows NTFS file system driver (ntfs.sys) lets an authenticated local user with low privileges read memory contents beyond an allocated buffer, resulting in local information disclosure (CWE-125, CVSS 3.1 5.5). Only hosts that have not applied Microsoft's current cumulative updates are affected; the EUVD data lists a broad range of client and server branches below their respective fixed builds (?fix versions include Windows 11 23H2 10.0.22631.7652, 24H2 10.0.26100.9711, 25H2 10.0.26200.9711, Windows 10 1607/Server 2016 10.0.14393.9612, and Windows 10 1809/Server 2019 10.0.17763.9376). There is no remote vector and CISA SSVC rates the flaw as non-automatable with only partial technical impact, and no public exploit code has been identified at time of analysis, so this is a genuine but low-priority disclosure primitive rather than a path to privilege escalation.
Information disclosure in the Microsoft Windows NTFS filesystem driver allows a local, low-privileged, authenticated attacker to read portions of kernel memory by triggering an integer underflow (wraparound) during a crafted NTFS operation, with no user interaction required. Exploitation is confined to the local attack vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and yields confidentiality impact only (C:H/I:N/A:N, score 5.5) - there is no write, code-execution, or denial-of-service effect, and CISA's SSVC analysis rates the issue as not automatable with no known exploitation. No public exploit code has been identified at time of analysis, and Microsoft has released a vendor patch covering all affected Windows client and server builds.
Information disclosure in Windows Message Queuing (MSMQ) Queue Manager allows an authenticated local attacker to read data from an affected host via a type confusion flaw. Exploitation requires the optional MSMQ feature to be installed and the Queue Manager service running (not enabled by default), and impact is limited to confidentiality with no code execution or privilege escalation. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Local information disclosure in the Microsoft Windows Search Component lets an authenticated low-privileged user read out-of-bounds memory contents on the affected host, giving a post-foothold attacker a confidentiality-only leak (CVSS 5.5, AV:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability impact. Every current Windows client and server branch is affected - Windows 10 1607/1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012 through 2025 including Server Core - so the exposure is broad even though the flaw cannot be used for remote initial access. No public exploit identified at time of analysis: CISA SSVC records Exploitation: none and Automatable: no, CISA KEV does not list this CVE, and no EPSS signal was provided; urgency is driven by patch hygiene rather than active threat activity. Microsoft has released fixes (see the MSRC update guide referenced below).
Information disclosure in the Windows Secure Kernel Mode component lets a locally authenticated attacker with low privileges read sensitive system information that should remain isolated inside the hypervisor-protected secure kernel, affecting Windows 10, Windows 11 and Windows Server 2016 through 2025 builds that predate Microsoft's fixed versions. Exploitation is constrained by high attack complexity and state-dependent conditions (CVSS AC:H, PR:L, AV:L), and there is no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none, the attack as non-automatable, and technical impact as partial. Microsoft has released patches, so this is a moderate-priority hardening item rather than an emergency response.
Heap-based buffer overflow in the Windows Storage Port Driver (CWE-122) lets an attacker who can physically interact with a target machine corrupt kernel pool memory and elevate privileges, with high impact to confidentiality, integrity, and availability (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 6.8). Unpatched Windows 11 builds (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025, including Server Core installations, are affected; no authentication or user interaction is required, but the attack depends absolutely on hands-on physical access, is not remotely reachable, and cannot be automated (SSVC Automatable=no, Exploitation=none). No public exploit identified at time of analysis, no confirmed active exploitation (not listed in CISA KEV), and a vendor patch is available.
Information disclosure in the Windows USB Print Driver allows a locally authenticated, low-privilege attacker to read beyond intended buffer boundaries and leak contents of driver memory on affected Windows 10, Windows 11, and Windows Server builds (2012 through 2025, including Server Core installations). Exploitation requires an existing foothold on the host with the ability to exercise the USB print driver code path (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), needs no victim interaction, and is limited to confidentiality impact - no data modification, no denial of service, and no remote vector. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' with partial technical impact, and an EUVD record (EUVD-2026-99784) tracks the same affected build list; vendor patches are available, making this a genuine but lower-tier patching priority compared with remotely reachable issues.
Out-of-bounds read in Windows Imaging Component (WIC) allows a locally authenticated attacker to disclose in-process memory contents when WIC processes a crafted or attacker-influenced image, with a CVSS of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Affected systems include a broad set of supported Windows 10, Windows 11, and Windows Server builds below their patched build thresholds, and exploitation requires prior low-privileged access to the host rather than remote network reachability. No public exploit identified at time of analysis, CISA SSVC reports exploitation none and automatable no, and Microsoft has released vendor updates to address the flaw.
Local tampering with Windows Security Account Manager (SAM) data is possible on unpatched Windows hosts because a critical SAM function performs no authentication or authorization check, letting an authenticated local user modify integrity-sensitive account information. Exploitation requires a pre-existing local session (AV:L, PR:L) and affects only integrity (C:N/A:N), so the practical impact is moderate rather than catastrophic, and no public exploit identified at time of analysis - SSVC rates exploitation as none and automatable as no. The flaw spans Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2022/2025 (including Server Core), all of which have vendor fixes available.
Information disclosure in Microsoft's Windows Projected File System (ProjFS) component allows an authenticated local user to read files or directories that should not be accessible to them, exposing content that the access-control model intended to keep restricted. Exploitation requires the attacker to already hold a local account on the target machine (CVSS PR:L, AV:L) and does not require user interaction, and per CISA's SSVC assessment it is neither actively exploited nor automatable. Affected builds span Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2019/2022/2025 including Server Core installations; no public exploit code has been identified and Microsoft has published fixes in its monthly cumulative updates, so real-world urgency is low and remediation is a routine patch cycle.
Local tampering with Windows Modern Device Management (MDM) is possible for an authenticated low-privileged attacker on affected Windows builds, allowing modification of MDM-related state or policy with high integrity impact but no confidentiality or availability impact. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms local access, low complexity, low privileges, no user interaction, and a medium 5.5 score; SSVC rates exploitation as none and non-automatable, and no public exploit has been identified at time of analysis. Vendor patches are available per Microsoft advisory, and affected platforms include Windows 10, Windows 11, and Windows Server releases listed in the Microsoft update guide.
Local authenticated attackers holding only low-level user privileges on a Windows host can cause the Device Association Service to misinterpret a resource's type (CWE-843 type confusion) and thereby leak sensitive information from the affected system. The flaw carries a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning it cannot be triggered remotely or by an unauthenticated user and does not by itself yield code execution, tampering, or denial of service, and there is no public exploit identified at time of analysis. Microsoft has shipped vendor fixes, and CISA's SSVC assessment records exploitation as none and the issue as non-automatable, so this is a moderate-priority patching and hardening item rather than an urgent, actively exploited threat.
Information disclosure in the Windows Win32 Kernel Subsystem stems from a time-of-check time-of-use (TOCTOU) race condition (CWE-367) that lets a local attacker with existing low-privileged code execution leak kernel memory contents. The issue rates only CVSS 4.7 (AV:L/AC:H/PR:L/UI:N, C:H/I:N/A:N) because seizing the narrow check-to-use window is difficult and non-deterministic; CISA's SSVC assessment scores Exploitation as 'none' and Automatable as 'no', and no public exploit code has been identified at time of analysis. Every in-support Windows 10, Windows 11 (21H2 through 26H2) and Windows Server 2012 through 2025 build below its respective patched build number is affected, and Microsoft has published fixes via its update guide.
Information disclosure in Windows Management Instrumentation (WMI) allows an authenticated local attacker to read past the end of an intended buffer, potentially exposing sensitive data held in the memory of the WMI service. The flaw affects a wide span of Windows builds - Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2, including 26H1), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - and requires the attacker to already hold a low-privileged local session on the host (CVSS 3.1 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Impact is confidentiality-only: no data modification, no denial of service, and no remote or unauthenticated path is indicated by the assessed vector. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as none and automatable as no, and Microsoft has released fixed builds for the affected branches.
Local information disclosure in Windows Modern Device Management (MDM) lets an authenticated, low-privileged attacker who already holds a foothold on the host read residual memory contents returned by the MDM subsystem. Rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), this is a local-only, low-complexity, no-user-interaction bug whose sole impact is confidentiality loss - there is no integrity or availability effect and no scope change. Vendor patches are available and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records exploitation as none, automatable as no, and technical impact as partial, which places this in the moderate-priority patch cycle rather than the emergency one.
Information disclosure in Windows Kernel-Mode Drivers on Windows 11 version 26H1 (builds 10.0.28000.0 and later, up to but not including 10.0.28000.3231) lets an authorized attacker who already holds a local low-privilege session read uninitialized kernel memory through a driver interface. The exposure is confined to confidentiality (C:H/I:N/A:N) with no code execution or modification primitive, and the attacker must already be logged on locally, so the issue is a moderate-severity leak rather than a privilege-escalation or remote attack path. There is no public exploit identified at time of analysis, the CISA SSVC assessment records exploitation as none and automatable as no, and Microsoft has published a fix in its update guide.
An out-of-bounds read in the WebDAV functionality of Microsoft Windows allows a locally authenticated, low-privileged attacker to read memory contents and disclose information; exploitation requires existing local access to the host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5), with no user interaction and low complexity. Affected systems span Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025, including Server Core installations, per the EUVD-listed build ranges. There is no CISA KEV entry and no public exploit identified at time of analysis (SSVC: Exploitation none, Automatable no), so this is a moderate, not urgent, priority best characterized as a post-compromise or malicious-insider information-disclosure aid rather than an initial-access vector.
An out-of-bounds read in the Remote Desktop Display Driver component of Microsoft Windows lets an authenticated, low-privileged local attacker disclose potentially sensitive memory contents on the affected host. Exploitation requires the attacker to already hold a local foothold on the machine (AV:L, PR:L) and to execute code that reaches the driver; no user interaction is needed (UI:N), and the impact is limited to confidentiality (C:H, I:N, A:N) with no code execution or system compromise by itself. No public exploit code has been identified at time of analysis, the flaw is not in CISA KEV, and CISA's SSVC framework rates it non-automatable with only partial technical impact, so real-world urgency is LOW despite the high confidentiality rating.
Improper access control in the Windows Routing and Remote Access Service (RRAS) allows an authenticated local attacker holding only low-level privileges to tamper with service state or configuration on affected Windows 10, Windows 11, and Windows Server builds. Exploitation is strictly local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), requires the optional RRAS role to be installed and enabled, and impacts integrity only - confidentiality and availability are unaffected, which is consistent with the moderate 5.5 base score. There is no public exploit identified at time of analysis and no evidence of confirmed active exploitation (CISA KEV), and vendor-released patches are available for every affected build branch.
Missing authorization in the Windows Overlay Filter (WOF) allows an authenticated local attacker to tamper with protected file/overlay data on affected Windows 10, Windows 11, and Windows Server 2016-2025 systems, producing an integrity-only impact (CVSS 5.5, CWE-862). The assessed vector (AV:L/PR:L/UI:N, C:N/I:H/A:N) means exploitation is neither remote nor unauthenticated: an attacker must already hold low-privileged local execution on the host, which confines real-world exposure to post-compromise and malicious-insider scenarios rather than a pre-auth or network attack. CISA SSVC records exploitation as "none" and no public exploit code has been identified at time of analysis; vendor patches are available from Microsoft, and this is a moderate-severity, low-urgency issue rather than an emergency.
An out-of-bounds read in the Windows Audio Service (Audiosrv) allows an attacker who already holds authenticated local access with low-level privileges to disclose memory contents from the affected host. The flaw is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning it is strictly a local, post-compromise information-disclosure issue - there is no remote vector, no integrity or availability impact, and no code execution. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records no exploitation activity and marks the issue as not automatable, so this is a genuine but low-urgency issue that should be handled through routine patching rather than emergency response.
Local tampering of network list data in the Windows Network List Service allows an authenticated low-privileged attacker to modify network profiles and settings, resulting in partial integrity impact while confidentiality and availability remain unaffected. Affected versions span Windows 10, Windows 11, and numerous Windows Server releases, with vendor patches available. No public exploit identified at time of analysis, and given the required local access and lack of remote vector, the risk is assessed as a moderate, low-priority integrity issue.
Uncontrolled resource consumption in the Windows RPC Endpoint Mapper service (listening on TCP 135) allows an unauthenticated, remote attacker to deny service over a network by exhausting service resources. Rated CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), the impact is availability-only and the High attack complexity means an outage is not achievable with a single trigger against default configurations, but requires sustained or precisely timed request volume. The affected surface spans Windows Server 2012 through Server 2025 (including Server Core) plus Windows 10 1607/1809/21H2/22H2 and Windows 11 23H2 through 26H2; no public exploit code and no confirmed active exploitation have been identified at time of analysis, and Microsoft has published a vendor update guide.
Information disclosure in Windows Kernel-Mode Drivers lets an authenticated local attacker read uninitialized kernel memory and leak residual kernel data on affected Windows 10, Windows 11, and Windows Server builds (Windows Server 2012 R2 through 2025). Exploitation requires a pre-existing standard local account and the ability to invoke the vulnerable driver code path; it is not remotely triggerable, needs no user interaction, and provides no code execution or system modification, so realistic value is as a kernel-memory-leak primitive inside a larger exploit chain. No public exploit code or confirmed active exploitation has been identified at time of analysis, and CISA SSVC rates the issue non-automatable, consistent with its low-to-moderate priority despite the CVSS 5.5 Medium score.
Local integrity tampering in the Windows Update Stack allows an authenticated low-privilege attacker who already holds a session on an affected Windows host to modify update-related configuration or state that should be protected, producing a high integrity impact with no confidentiality or availability effect. The flaw (CWE-15, external control of a system or configuration setting) touches a broad set of Windows 10, Windows 11, and Windows Server branches from 1809/21H2 through 26H1/26H2 and Server 2019/2022/2025. Vendor patches are available, no public exploit code or active exploitation has been identified, and CISA's SSVC assessment records exploitation as none with the issue rated non-automatable, so real-world risk is largely confined to insiders or post-compromise tampering rather than scalable remote attacks.
Information disclosure in Windows Health and Optimized Experiences Service on Windows 11 allows a locally authenticated low-privileged attacker to read sensitive data from the service because a critical function lacks proper authentication (CWE-306). The issue is local-only, requires an existing low-privileged session, and has low attack complexity but no user interaction; it does not permit privilege escalation or modification, and no public exploit has been identified at time of analysis. Microsoft has released a vendor patch, and this is a moderate, low-priority issue rather than an urgent threat.
Information disclosure in the Windows Event Log service allows an authenticated local attacker to read potentially sensitive memory contents. Affecting a broad range of Windows 10, 11, and Server editions, this low-severity flaw requires prior local access and only results in confidentiality impact, with no code execution or privilege escalation. No public exploit identified at time of analysis, and Microsoft has released patches.
An out-of-bounds read in the Microsoft Windows Storage Port Driver (CWE-125) lets an attacker who already has physical access to a device read past the end of a buffer and disclose kernel memory contents to an unauthorized party. Every supported Windows client and server build from Windows 10 1607 and Windows Server 2012 through Windows 11 26H2 and Windows Server 2025 is affected, as tracked in EUVD-2026-100340, and because the vector is AV:P the flaw cannot be reached remotely - it is confined to lost, stolen, or unattended hardware and evil-maid style scenarios. Microsoft has released a vendor patch, there is no public exploit identified at time of analysis, and CISA's SSVC decision framework rates exploitation as none and the issue as non-automatable, making this a genuinely low-priority item despite the CVSS confidentiality rating of High.
Improper authorization in the Windows Encrypting File System (EFS) lets an already-logged-in local user tamper with protected data that they should not be permitted to modify, yielding a high integrity impact with no confidentiality or availability impact (CVSS 5.5, AV:L/PR:L/UI:N, C:N/I:H/A:N). Only Windows 10, Windows 11, and Windows Server hosts that have not yet applied the current cumulative updates are exposed; the attack is strictly local, requires an interactive session and at least low-level privileges, and there is no public exploit identified at time of analysis (no CISA KEV entry, SSVC exploitation: none, EPSS not notable). This is a genuinely moderate, low-urgency issue rather than a high-priority emergency: vendor patches already exist for every affected build, so exposure is limited to unpatched systems where a low-privileged local user could subvert EFS authorization checks.
An out-of-bounds read (CWE-125) in Microsoft Digest Authentication on unpatched Windows client and server builds lets an authenticated local user disclose information from the host; the CVSS 3.1 vector (AV:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms the attacker must already hold low-level privileges on the machine, needs no user interaction, and can only read data - with no impact on integrity or availability. Because reachability is local rather than remote, the component is the Windows Digest/SASL authentication provider itself, and exploitation is limited to memory disclosure on systems that have not yet installed the vendor fixes identified by EUVD build numbers. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and SSVC assesses the issue as not automatable with no observed exploitation, so it should be treated as a low-to-moderate-priority hardening item rather than an emergency.
An out-of-bounds read in the Windows Key Storage Provider (KSP) allows an authenticated, low-privileged local user to disclose memory contents from the calling process, as rated CVSS 3.1 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only systems running Windows builds below the fixed levels published in the Microsoft update guide and EUVD (for example, Windows 11 24H2 below 10.0.26100.9711 or Windows Server 2025 below 10.0.26100.33650) are affected; patched builds are not exploitable. The issue requires an existing local session and valid credentials, is not remotely reachable, and there is no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, making this a moderate-severity, low-priority issue in practice.
Information disclosure in the Windows WebDAV component lets an authenticated, low-privileged attacker read files or directories that should not be exposed over the network (CWE-552), rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, high confidentiality impact, no integrity or availability impact). The flaw affects a broad set of unpatched Windows client and server SKUs - Windows 10, Windows 11, and Windows Server 2012 through 2025 - wherever WebDAV is present and network-reachable. Exploitation is not remote-unauthenticated: it requires a valid low-privilege account plus WebDAV exposure, CISA's SSVC rates exploitation as not observed, non-automatable and only partial technical impact, and no public exploit code has been identified at time of analysis. Vendor patches are available.
Missing authorization checks in the Windows WebDAV component allow an attacker who already holds valid low-privilege credentials to bypass a security feature over the network, affecting only integrity (no confidentiality or availability impact). Microsoft rates this CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), meaning exploitation is straightforward once an authenticated foothold exists but does not permit data theft or denial of service. Vendor fixes are available; at time of analysis there was no public exploit code and no confirmed active exploitation (not in CISA KEV).
Tampering of Windows Host Guardian Service (HGS) configuration and attestation-related data is possible for an authenticated local attacker on hosts where the HGS role is deployed, yielding high integrity impact with no loss of confidentiality or availability. Rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) under CWE-250, this is a moderate-severity, low-priority issue rather than an urgent threat: Microsoft has released patched builds, no public exploit code has been identified at time of analysis, and CISA's SSVC decision framework records Exploitation: none and Automatable: no. Exposure is narrow, confined to guarded-fabric/shielded-VM environments where the HGS server role is installed rather than to general Windows installations.
An out-of-bounds read in the Windows Remote Access Service Infrastructure lets an attacker who already holds a low-privilege local session on the host read beyond the bounds of an allocated buffer and disclose information from process memory. Exploitation requires both local access (AV:L) and an authenticated low-privilege context (PR:L) per the assessed CVSS vector, with no network-facing or unauthenticated path, and CISA's SSVC assessment marks it non-automatable with only partial technical impact, so this is a moderate-severity disclosure issue rather than a top-tier emergency. No public exploit code has been identified at time of analysis, though the affected component ships across an unusually broad footprint: Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025, including Server Core installations.
A security-feature bypass in the Windows Kernel (CVE-2026-85939, CVSS 5.3) lets an authenticated attacker with only low-level privileges (PR:L per the CVSS vector) reach and subvert a kernel security control over the network, with the outcome limited to integrity impact - no loss of confidentiality or availability. Exploitation is not deterministic: the high attack-complexity rating (AC:H) indicates success depends on conditions outside the attacker's direct control, such as a race or timing window or a specific runtime state, and the affected kernel feature is not named in the available description. A vendor patch is available, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; the risk is moderate and best addressed through prompt cumulative-update deployment across all supported Windows client and server branches listed in the advisory.
Information disclosure in the Windows Broadcast DVR User Service (BcastDVRUserService) allows an attacker with local access and low-level authenticated privileges to read information they are not authorized to see on affected Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2019 hosts. Tracked as CWE-862 (missing authorization) with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the flaw is not remotely reachable and requires an existing foothold on the target machine, with confidentiality the only impacted property and no effect on integrity or availability. No public exploit code has been identified at time of analysis, and the CISA SSVC assessment records exploitation as 'none' and automatable as 'no', making this a moderate, low-priority issue despite affecting a ubiquitous platform; vendor patches are available.
A local information-disclosure flaw in the Windows USB Driver component allows an attacker who already holds authenticated low-privilege access on a Windows host to read past the end of a kernel buffer and leak memory contents back to the caller. Because the CVSS vector is AV:L/PR:L/UI:N, exploitation requires a pre-existing local foothold and direct interaction with the driver on the affected machine; there is no network-reachable attack path and no user interaction is needed once that access exists. Impact is limited to confidentiality (C:H) with no integrity or availability effect, making this an information-leak primitive (useful for defeating ASLR or extracting pointer data) rather than a direct path to code execution, and there is currently no public exploit identified at time of analysis and no CISA KEV listing.
Local information disclosure in Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025 lets anyone who already holds a local user session read private personal information they should not be able to access, yielding a HIGH confidentiality impact (CVSS 6.2, CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability effect. The flaw is not remotely reachable and requires no authentication or user interaction beyond the local foothold, so the practical exposure is limited to hosts where an attacker has already gained local code execution on an unpatched build. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC reports Exploitation: none, Automatable: no), and the moderate score plus the local-only vector point to LOW real-world urgency even though the data disclosed is sensitive.
Information disclosure in the Windows StateRepository API permits a locally authenticated low-privileged attacker to read beyond allocated buffers and disclose memory contents on Windows 11 and Windows Server 2025. The flaw requires local code execution with a valid account (PR:L/AV:L) and no user interaction; remote or unauthenticated attackers cannot trigger it directly. No public exploit code or active exploitation is known (CISA SSVC: none), and Microsoft has released patches for all affected builds.
Local information disclosure in the Windows Universal Disk Format File System (UDFS) driver allows an authenticated local attacker to leak memory contents by supplying a crafted UDF-formatted volume - such as a malicious ISO disc image, UDF-formatted removable media, or a mountable disk image - for the driver to parse. Successful exploitation is limited to confidentiality impact (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5), with no code execution, persistence, or denial of service; CWE-822 points to improper handling of an untrusted pointer/offset during parsing. There is no public exploit identified at time of analysis, CISA's SSVC assessment rates the issue as non-automatable with partial technical impact, and vendor-released patches are available, so this is a moderate-severity, low-urgency issue across supported Windows client and server releases.
Information disclosure in the Windows ALPC (Advanced Local Procedure Call) subsystem allows a locally authenticated, low-privileged attacker to read sensitive system information that should not be reachable from their privilege level. The flaw carries a CVSS v3.1 base score of 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning exploitation requires an existing interactive session on the host plus a non-trivial race or state precondition, and yields confidentiality impact only - no integrity or availability effect. Affected builds span Windows 10 21H2/22H2/1809, Windows 11 23H2 through 26H2, and Windows Server 2019/2022/2025; a vendor patch is available through the Microsoft Update Guide, and there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).
Denial of service in Microsoft Windows Message Queuing (MSMQ) Queue Manager allows an authenticated, low-privileged remote attacker to crash the service by triggering a null pointer dereference, rendering the queuing service unavailable to legitimate applications on the affected host. Exploitation is constrained: MSMQ is an optional, non-default Windows component that must be installed, running, and network-reachable (typically TCP 1801), and the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms credentials are required while no user interaction is needed. Impact is purely availability (A:H with C:N/I:N) - no data exposure or modification - and there is no public exploit identified at time of analysis (CISA SSVC exploitation: none); vendor patches are available for all affected Windows client and server branches.
Information disclosure in Windows Kernel-Mode Drivers lets a locally authenticated user with only low-level privileges read sensitive information that the driver writes into its log files, affecting a broad range of Windows client and server releases from Windows Server 2012 through Windows 11 26H2 and Windows Server 2025. The flaw is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so it is strictly local, requires prior authentication, needs no victim interaction, and causes only confidentiality loss on a host the attacker has already accessed. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as none and the issue is not automatable, and Microsoft has released patched builds for all affected editions, making real-world urgency low despite the high confidentiality sub-score.
Information disclosure in Windows Management Instrumentation (WMI) allows an attacker who already holds a local, low-privileged foothold on a Windows host to read memory contents that should not be exposed to them. The flaw is an out-of-bounds read (CWE-125) triggered through a locally reachable WMI code path; no user interaction is required and attack complexity is low once local access exists, but the vector is strictly local and authenticated (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5), with impact limited to confidentiality - no code execution, integrity modification, or denial of service. There is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as 'none'; vendor patches are available and fully updated Windows 10, Windows 11, and Windows Server builds are not exposed.
An out-of-bounds read in the Windows Print Spooler lets an unauthenticated remote attacker disclose memory contents over the network, but only if a victim is first induced to interact with an attacker-controlled print resource or crafted spooler response. Microsoft rates this 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), so impact is confined to confidentiality - there is no code execution, data modification, or denial of service. All supported Windows client and server builds are affected, including Server Core installations, yet no public exploit has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', which keeps real-world priority low-to-moderate; vendor patches are available and should be applied through normal patch cycles.
Information disclosure in the Windows Event Viewer allows an authenticated attacker with low-level authorization (CVSS PR:L) to reach the component over the network (AV:N) and read files or directories that should not be exposed, resulting in high confidentiality impact with no integrity or availability effect. The flaw, tracked as CVE-2026-85840 and rooted in CWE-552, is rated 6.5 and affects a very broad set of Windows client and server builds, including Windows 10, Windows 11 (21H2 through 26H2) and Windows Server 2012 through 2025. CISA's SSVC assessment records no observed exploitation and no automatable attack path, and no public exploit code has been identified at time of analysis; vendor patches are available, so exposure is concentrated on unpatched, multi-user or shared-access hosts such as RDS/terminal servers and jump boxes where many low-privileged accounts coexist.
Information disclosure in the Windows Biometric Service (WbioSrvc) allows a locally authenticated attacker with low privileges to trigger a heap-based buffer overflow and over-read heap memory handled by the service, potentially exposing sensitive data. The flaw affects Windows 10, Windows 11, and Windows Server builds tracked as EUVD-2026-99540 and requires an existing local foothold, with no network vector and no victim interaction; the assessed impact is confined to confidentiality loss with no code execution, integrity, or availability effect. Microsoft has released patches, CISA's SSVC assessment records exploitation as 'none' and automation as 'no', and no public exploit has been identified at time of analysis, making this a moderate-severity, low-urgency fix rather than an emergency.
Out-of-bounds read in the Microsoft Windows Installer component allows an authenticated attacker with low-level local privileges to read memory contents outside intended bounds and disclose information from the affected host. The flaw affects a broad set of Windows client and server builds, including Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1/26H2), Windows Server 2012 through 2025, and their Server Core installations; exploitation requires a pre-existing local foothold, as the assessed vector is AV:L/PR:L with no remote or unauthenticated path, and impact is confined to confidentiality (C:H/I:N/A:N) with no code execution or availability effect. There is no public exploit identified at time of analysis, CISA's SSVC evaluation rates exploitation as none and non-automatable, and the vendor has released fixes, so this is a moderate-severity local disclosure issue rather than an urgent remote threat.
Information disclosure in the Windows Universal Disk Format (UDFS) file-system driver lets an authenticated local attacker read memory beyond the bounds of an allocated buffer by presenting a crafted UDF volume - typically a rigged ISO image, optical disc, or virtual/removable disk - for the kernel driver to mount and parse. The flaw is an out-of-bounds read (CWE-125) rated 6.5 MEDIUM; although the supplied CVSS vector advertises network reachability (AV:N), the file-system parsing path and the description's 'locally' wording indicate that local, authenticated access is required, so defenders should treat the vector as AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. Impact is bounded to confidentiality with no code execution or data tampering, no public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and the attack as non-automatable, and vendor patches are available - together these signals keep real-world urgency moderate-to-low despite the MEDIUM score.
Out-of-bounds read in the Windows Wi-Fi Driver (CWE-125) allows an attacker who already sits on the same wireless network or local Layer-2/broadcast segment as the target - and who already holds low-level privileges on that adjacent segment - to read beyond the bounds of a kernel buffer and disclose information from the affected Windows system. The issue affects a broad range of supported builds, from Windows 10 1607 through Windows 11 26H2 and the corresponding Windows Server 2016/2019/2022/2025 releases, all of which are fixed by the current cumulative updates. Impact is limited to confidentiality (CVSS:3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.7); there is no integrity or availability impact, no code execution or privilege escalation, no public exploit code identified at time of analysis, and CISA's SSVC rates exploitation as none and automatable as no, making this a moderate, patch-routinely item rather than an emergency.
An out-of-bounds read (CWE-125) in the Windows Device Association Service lets an authenticated, low-privileged local user read memory past the end of an allocated buffer and disclose its contents, producing a high confidentiality impact with no integrity or availability effect (CVSS 5.5, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The affected surface covers Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations, but exploitation requires an existing local account/session on the host because there is no network-facing vector and no user interaction is needed. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as none and the flaw as not automatable, and patch availability from Microsoft makes this a moderate, low-urgency remediation item rather than an emergency one.
Local information disclosure in the Windows Bind Filter (bindflt.sys) driver allows an authenticated local attacker with low privileges to read files outside their intended boundary on unpatched Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 systems. The flaw is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and is a CWE-552 improperly-restricted file/directory access issue in the kernel-mode driver that underpins filesystem bind/redirection mounts. Vendor-released patches are available with fixed builds listed in the EUVD ranges, and no public exploit identified at time of analysis; the SSVC assessment shows exploitation none and not automatable, so risk is moderate and limited to hosts where an attacker already holds a local, authenticated foothold.
Security feature bypass in Windows PowerShell allows an unauthenticated attacker to defeat a security check, but the victim must actively run or open attacker-supplied content (UI:R), so it is not a hands-off remote exploit. Impact is integrity-only (C:N/I:H/A:N, CVSS 6.5); Microsoft has released patches, CISA SSVC rates exploitation as none and automatable as no, and no public exploit code was identified at time of analysis.
An out-of-bounds read in the Windows Routing and Remote Access Service (RRAS) allows an attacker who already holds valid credentials for a low-privileged local account to read memory beyond the bounds of an allocated buffer and disclose information from the affected host; no user interaction is required. The exposure is narrowed considerably by two prerequisites: RRAS is a non-default role that must be installed and running, and exploitation requires local access plus low-privileged authentication, so there is no remote or unauthenticated path. Impact is confidentiality-only (high) with no integrity or availability effect, and no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and the activity as not automatable, making this a moderate, low-urgency issue rather than a top patching priority.
Local information disclosure in the Windows Sysmain service allows an authenticated attacker with low-level local privileges to access sensitive system information on unpatched Windows 10, Windows 11, and Windows Server builds. Exploitation requires existing local access and valid credentials (CVSS PR:L), with no user interaction needed, and is limited to confidentiality impact; no public exploit identified at time of analysis, and CISA SSVC records no exploitation. Microsoft has released vendor patches for the affected builds via its MSRC advisory.
Use-after-free in the Microsoft QUIC (MsQuic) Schannel native library allows an unauthenticated, remote attacker who can reach a QUIC/HTTP-3 endpoint to disclose memory contents over the network, with impact limited to confidentiality (no integrity or availability effect). Affected software includes .NET applications referencing the Microsoft.Native.Quic.MsQuic.Schannel package in versions 1.9.0 through 2.6.1, plus a broad set of Windows 11 and Windows Server 2022/2025 builds and Visual Studio 2022/2026 that ship the vulnerable QUIC binaries. Exploitation is non-deterministic because the CVSS vector (AC:H) reflects a race condition the attacker must win, and no public exploit code has been identified at time of analysis; the CISA SSVC assessment records exploitation as none and the issue as not automatable, making this a genuine-but-moderate risk rather than a fire-drill.
An out-of-bounds read in Windows Installer allows an authenticated, low-privileged local user to disclose information from the affected host, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation requires the attacker to already hold a low-privileged local account and the ability to have Windows Installer (msiexec) process a crafted MSI package on that machine; the vulnerability cannot be triggered remotely or by an unauthenticated user, and no victim interaction is required. Impact is bounded to confidentiality - there is no code execution or privilege escalation from this flaw alone, CISA SSVC records exploitation as none, and no public exploit has been identified at time of analysis; a vendor patch is available.
An out-of-bounds read in the Windows Remote Desktop Client lets a malicious or compromised RDP server leak process memory, giving an unauthenticated attacker a network-based information disclosure path against any Windows host whose user connects to that server. The flaw is strictly client-side: the victim must initiate an outbound RDP session (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5), which is the main limiting factor, while confidentiality impact is rated High and no authentication, integrity, or availability impact is involved. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as "none" and automatable as "no", and Microsoft has published remediation through its Security Update Guide, making this a moderate-priority issue rather than a top-tier emergency.
Out-of-bounds memory read in the Windows Device Association Service (DAS) allows a locally authenticated, low-privileged user on Windows 10, Windows 11 and Windows Server 2012 through 2025 to make the service return data past the end of an allocated buffer, disclosing memory contents. The vector (AV:L/PR:L/UI:N, C:H/I:N/A:N) confirms the attacker must already be able to execute code locally and needs no victim interaction, and no public exploit code has been identified at time of analysis; CISA's SSVC rates exploitation as 'none' with partial technical impact and non-automatable, so this is best characterised as a secondary primitive (for example an ASLR or memory-layout bypass) rather than a standalone compromise path. Microsoft has released vendor patches, and because DAS ships enabled by default on all supported Windows editions, every unpatched host in the listed build ranges carries the exposure.
Information disclosure in the Windows Device Association Service (DAS) lets an attacker who already holds valid low-privileged credentials on a target host read portions of the service's memory over the network, exposing potentially sensitive data. The flaw affects default installations of Windows 10, Windows 11 (23H2 through 26H2/26H1), Windows Server 2012 R2, 2016, 2019, 2022, and 2025 below their respective patched builds, and carries a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning confidentiality-only impact with no code execution, modification, or denial of service. Microsoft has released fixes and CISA's SSVC evaluation records no exploitation and no automatable exploitation at time of analysis, with no public exploit identified; the PR:L authentication prerequisite and read-only outcome materially reduce real-world urgency.
Information disclosure in the Windows Print Spooler on affected client and server editions lets an authenticated local user obtain uninitialized memory contents from spooler components, potentially exposing residual sensitive data held by a privileged process. The flaw is rated 5.5 (CVSS:3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning exploitation is strictly local, requires a valid low-privileged account with local code execution or session access, needs no user interaction, and cannot be triggered remotely or by an unauthenticated attacker. Exploitation against CVE-2026-85320 is not currently observed, no public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none, so exposure is concentrated in shared multi-user hosts such as RDP servers, terminal servers and jump boxes; Microsoft has released patches.
Improper authorization logic in the Windows SMB Client lets an authenticated local user bypass a Windows security feature, yielding a high-integrity impact on the affected system (CVE-2026-84011, CVSS 5.5). Exploitation requires an attacker to already hold valid low-privileged credentials and local code execution on the host (CVSS vector AV:L/PR:L/UI:N), so this is a post-compromise privilege-context escalation rather than a remotely reachable flaw; no confidentiality or availability impact is assessed. There is no public exploit identified at time of analysis and CISA SSVC rates exploitation as "none" with the issue considered non-automatable; Microsoft has released fixed builds for all affected Windows 11 and Windows Server 2022/2025 editions.
Local tampering in the Windows Projected File System (ProjFS) component allows an authenticated, low-privileged attacker who already holds a foothold on the machine to win a time-of-check time-of-use race and alter data the component is handling. The flaw is scored CVSS v3.1 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N) - it is not remotely reachable, requires local authenticated access, and is gated by high attack complexity, so success depends on repeatedly hitting a narrow race window rather than a single deterministic action, with the only impact being a high integrity/tampering effect and no confidentiality or availability loss. No public exploit has been identified at time of analysis - there is no CISA KEV listing, and CISA's SSVC assessment rates exploitation as 'none' and the issue as not automatable - while Microsoft has published a fix, making this a low-to-moderate priority patching item rather than an emergency.
Improper link resolution in the Windows Update Orchestrator Service allows a locally authenticated, low-privileged attacker to read files they would not otherwise be permitted to access on Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2022/2025. Because the service runs as SYSTEM and dereferences filesystem paths without validating reparse points, an attacker who already holds a foothold can plant a symbolic link, junction or hard link and race the service into opening a protected file, yielding high-confidentiality information disclosure with no integrity or availability impact (CVSS 5.5). Exploitation is assessed as non-automatable under CISA's SSVC framework, no public exploit code has been identified at time of analysis, and overall risk is comparatively low-priority given the local, post-compromise prerequisites.
Improper certificate validation in Windows Hello lets an attacker who already holds high local privileges on an affected Windows host bypass the feature's certificate-based authentication check, exposing credential material that Windows Hello would otherwise protect (confidentiality impact only). The defect is strictly local - there is no network attack path and no user interaction is required - and it affects Windows 10, Windows 11 and Windows Server builds below their respective patched levels, including Windows 11 24H2 (below 10.0.26100.9711) and Windows Server 2025 (below 10.0.26100.33650). Exploitation has not been observed: CISA's SSVC assessment records exploitation status 'none' and automatable 'no', and no public exploit code has been identified at time of analysis, making this a moderate-severity issue best handled by routine patching rather than emergency response.
Information disclosure in the Windows Win32 kernel subsystem allows an authenticated local attacker holding low-level privileges to read sensitive system data that should be confined to a more privileged control sphere. Unpatched Windows 10, Windows 11 and Windows Server builds are affected, and triggering the flaw requires local interactive or code-execution access plus a hard-to-control precondition, which is why the vendor scores it only 4.7 (AV:L/AC:H/PR:L/UI:N, C:H/I:N/A:N - confidentiality impact only, no integrity or availability loss). No public exploit was identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and the issue as not automatable, and vendor-released patches are available from Microsoft.
Local information disclosure in Microsoft Windows Hello allows an attacker who already holds low-privileged authenticated access on a Windows 10 or Windows 11 host to read sensitive system data that should be outside their control sphere. Exploitation requires local interactive access (AV:L, PR:L), involves no victim user interaction (UI:N), and yields only confidentiality impact - no code execution, tampering, or denial of service - which is why our assessment rates this a genuine but comparatively low-priority issue rather than an urgent one. There is no evidence of active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, SSVC rates it not automatable, and Microsoft has released fixed build floors for every affected branch.
Spoofing in Windows Shell allows unauthenticated remote attackers to impersonate trusted content by exploiting an incorrectly implemented authentication algorithm (CWE-303), requiring the victim to interact with attacker-supplied content (UI:R). Affects Windows 11 versions 23H2, 24H2, 25H2, 26H1, 26H2 and Windows Server 2025 (including Server Core installation) on builds prior to the patched versions, with high confidentiality impact but no integrity or availability loss. No public exploit identified at time of analysis (CISA SSVC: Exploitation none).
Information disclosure in the Windows Shell lets an attacker who already holds a valid low-privileged local account on a Windows host read sensitive system information that should fall outside that account's access sphere. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms this is not remotely reachable, requires an authenticated local logon, needs no user interaction, and is gated by high attack complexity such as a race condition or a specific system state the attacker must win, so reliability is limited; only confidentiality is affected. No public exploit code and no confirmed active exploitation have been identified at time of analysis (CISA SSVC records Exploitation: none, Automatable: no), and the patch is available from the vendor, making this a low-to-moderate priority issue despite the critical confidentiality rating.
An out-of-bounds read in the Windows HID Parser Library (hidparse.sys) allows an attacker who already holds low-privileged local access to read beyond the bounds of a buffer and disclose kernel memory contents to user space, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation is local only - the attacker must be authenticated on the host and must cause the parser to process a malformed HID report descriptor, typically by attaching or emulating a crafted USB or Bluetooth HID device - and the result is read-only information disclosure with no code execution or system modification. No public exploit has been identified at time of analysis, CISA SSVC records no observed exploitation and rates the issue non-automatable with partial technical impact, and a vendor patch is available from Microsoft (MSRC update guide, EUVD-2026-100040).
An out-of-bounds read in the Windows HID Parser Library lets an authenticated, low-privileged local attacker disclose information from the host by inducing the parser to process a malformed or attacker-influenced HID report or descriptor, yielding a CVSS v3.1 score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only confidentiality is affected - there is no integrity or availability impact - and because the vector requires PR:L and AV:L, an attacker must already hold a local authenticated session, making this a post-compromise or malicious-insider concern rather than a remotely reachable one. Vendor patches are available and no public exploit has been identified at time of analysis, and CISA's SSVC assessment records exploitation as none and automatable as no, reinforcing a moderate-severity, low-priority rating in practice.
Information disclosure in the Windows Win32 Kernel Subsystem allows an authenticated local user who can already execute code on the host to read sensitive system information that should remain outside their control. Exploitation is gated by a hard-to-satisfy, attacker-uncontrollable condition (CVSS AC:H), so the flaw is unreliable to trigger, and the impact is confidentiality-only with no integrity or availability loss. There is no CISA KEV listing and no public exploit identified at time of analysis, and Microsoft has shipped fixed builds for every affected Windows client and server branch, making this a genuinely low-priority, moderate-severity issue despite the ubiquity of the platform.
Privilege escalation in the Windows Win32 Kernel Subsystem stems from a heap-based buffer overflow (CWE-122) that an attacker with physical access to a target machine can trigger to gain SYSTEM-level privileges; once physical contact is achieved, no authentication or user interaction is required. Microsoft has released vendor patches, and no public exploit code or active exploitation has been identified at time of analysis (SSVC exploitation: none, automatable: no). Because the attack vector is physical (CVSS AV:P) with a 6.8 score, realistic risk is limited to insiders, shared or kiosk endpoints, and lost or stolen devices rather than remote attackers.
Local information disclosure in the Windows Clipboard User Service lets an authenticated attacker who already holds a low-privileged foothold on the host read sensitive system information the service is meant to keep segregated (CVSS 3.1 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only confidentiality is affected - integrity and availability are untouched - and exploitation requires valid local credentials, so it cannot be reached remotely or by an unauthenticated actor. Microsoft has published fixes for all supported Windows client and server branches; no public exploit code exists and there is no confirmed active exploitation (CISA SSVC exploitation: none, automatable: no, technical impact: partial), making this a moderate, low-priority hardening item.
Local information disclosure in the Windows HID Parser Library (CWE-125, out-of-bounds read) affects Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2019/2022/2025, allowing a low-privileged local actor to read memory beyond an intended buffer and potentially disclose sensitive data. Successful exploitation requires local, authenticated access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) plus the ability to get the parser to process attacker-influenced HID descriptor or report data, for example via an attached or emulated USB HID device; integrity and availability are unaffected. The issue is rated moderate rather than high priority: there is no public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and a vendor-released patch is available from Microsoft.
Out-of-bounds read in the Windows HID Parser Library lets an attacker who already holds authenticated local access to a Windows host read beyond the bounds of a parser buffer by supplying a crafted or emulated HID input (for example a malicious USB HID device or a malformed HID report descriptor), resulting in local information disclosure. The affected component is only reachable after local authentication and requires attacker-controlled HID traffic, and the outcome is limited to confidentiality loss (C:H) with no integrity or availability impact and no scope change, so this is a genuine but comparatively low-urgency issue. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as "none" and the issue as non-automatable, and vendor-released patches are available in the form of the Windows build updates listed below.
Spoofing of data protected by the Windows Virtualization-Based Security (VBS) Enclave is possible for a local attacker who already holds a low-privileged foothold on the machine, because the enclave relies on encryption of insufficient strength. Exploitation requires the VBS Enclave feature to be in use and is constrained by high attack complexity (AC:H) and non-automatable conditions per SSVC, and it yields integrity/spoofing impact only (I:H) with no confidentiality or availability loss. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation; severity is moderate (CVSS 5.6) and a vendor patch is available.
An out-of-bounds read in the Windows HID Parser Library lets a locally present, low-privileged authenticated attacker disclose information from the affected system's memory by supplying a malformed HID descriptor or report to the parser. The flaw is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) and yields confidentiality impact only - no code execution, no privilege escalation, and no integrity or availability effect - though leaked memory contents could assist follow-on attacks. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as 'none' and automatable as 'no', and Microsoft has published a patch; exploitation requires an existing local foothold plus the ability to feed crafted HID data (physical, emulated, or virtual HID device).
An out-of-bounds read in the Windows HID Parser Library allows an attacker who already holds a valid local session on an affected Windows host to disclose memory contents by supplying crafted or malformed HID descriptor data (for example via an emulated or malicious USB/Bluetooth HID device, or a local process feeding HID input). Exploitation requires local access and low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) and results in information disclosure only - no code execution, integrity, or availability impact - and no public exploit was identified at time of analysis, with CISA's SSVC rating exploitation as none and the flaw as non-automatable. Microsoft has released patched builds for all affected Windows 10, Windows 11, and Windows Server editions, so this is a moderate, not urgent, priority that is resolved by applying current cumulative updates.
Local information disclosure in the Windows Aggregated Data Platform Service allows an authenticated, low-privileged user on an affected Windows 11 host to read past the bounds of an in-memory buffer and potentially expose sensitive data that the account would not otherwise be entitled to see. Only unpatched Windows 11 builds - 24H2 below 10.0.26100.9711, 25H2 below 10.0.26200.9711, 26H2 below 10.0.26300.9711, and 26H1 below 10.0.28000.3231 - are affected; the CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (5.5) confirms the attacker must already hold a local account and that no integrity or availability impact is possible. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC: Exploitation none, Automatable no), and no EPSS score was supplied; the mandatory local foothold keeps this a moderate-severity, patch-cycle item rather than an emergency.
Local file tampering through a relative path traversal flaw in Windows WinINet (wininet.dll) requires an attacker to already hold authenticated, low-privileged access to the machine and to satisfy a high-complexity precondition, so it cannot be triggered remotely and carries no confidentiality or availability impact. All supported Windows client and server branches are affected - Windows 10 and 11 releases plus Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - up to the fixed build numbers published in Microsoft's update guide. No public exploit code has been identified, CISA's SSVC assessment records exploitation as 'none', and Microsoft rates the issue Medium (CVSS 4.7), making it a routine patch-cycle item rather than an emergency.