CVE-2026-85910
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Buffer over-read in Windows StateRepository API allows an authorized attacker to disclose information locally. The vulnerability may result in leakage of memory data.
Risk Assessment
An attacker with local access could read sensitive information from API memory, potentially facilitating further attacks. The risk is limited to the local context.
Recommendation
Apply patches for Windows StateRepository API promptly and monitor for unusual API calls.
Other vulnerabilities in Windows StateRepository API
See all- CVE-2026-85911High
Use after free in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
- CVE-2026-70218High
Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
- CVE-2026-102216High
Access of resource using incompatible type ('type confusion') in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
- CVE-2026-49170High
Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
Original NVD description (English source)
Buffer over-read in Windows StateRepository API allows an authorized attacker to disclose information locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS