CVE-2026-78452: CWE-125: Out-of-bounds Read in Microsoft Windows 10 Version 1809

This vulnerability involves an out-of-bounds read in the Windows SCSI Class System File component of Microsoft Windows 10 Version 1809 and later versions. It enables an unauthorized attacker with physical access to the system to read memory outside the intended bounds, potentially disclosing sensitive information. The CVSS 3.1 vector indicates the attack requires physical access (AV:P), low attack complexity (AC:L), no privileges (PR:N), no user interaction (UI:N), and impacts confidentiality (C:H) without affecting integrity or availability. Microsoft has published an official fix for this vulnerability.

The vulnerability allows unauthorized disclosure of information due to an out-of-bounds read, which can compromise confidentiality. It requires physical access to the affected system, limiting remote exploitation. There is no impact on integrity or availability. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78452 to remediate this vulnerability.