CVE-2026-59136
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Use of an uninitialized resource in Microsoft COM for Windows allows an authorized attacker to disclose information locally.
Risk Assessment
An attacker could exploit this to read unauthorized data from memory, potentially leading to sensitive information leakage.
Recommendation
Apply vendor security patches and limit trust in local processes using COM.
Other vulnerabilities in Microsoft COM
See all- CVE-2026-69909High
Heap-based buffer overflow in Microsoft COM for Windows allows an authorized attacker to elevate privileges locally.
- CVE-2026-69299High
Use after free in Microsoft COM for Windows allows an authorized attacker to elevate privileges locally.
- CVE-2026-69294Medium
A vulnerability in Microsoft COM for Windows causes error messages to contain sensitive information. This allows an authorized attacker to disclose information locally.
Original NVD description (English source)
Use of uninitialized resource in Microsoft COM for Windows allows an authorized attacker to disclose information locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS