CVE-2026-37452 describes an insecure permissions vulnerability in MSI NBFoundation Service version 2.0.2506.1201. The issue resides in the MSIAPService.exe component, enabling a remote attacker to access sensitive information. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information) and does not require privileges or user interaction to exploit. The CVSS 3.1 base score is 7.5, reflecting high impact on confidentiality with no impact on integrity or availability. No known exploits are reported in the wild, and no vendor remediation or patch is currently documented.

A remote attacker can obtain sensitive information from the affected MSI NBFoundation Service component without authentication or user interaction. The confidentiality of data is compromised, but integrity and availability are not affected. This could lead to unauthorized disclosure of sensitive information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. In the meantime, restrict network access to the MSIAPService.exe component to trusted sources to reduce exposure.