CVE-2026-42906

EUVD-2026-35595
Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose information locally.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Windows Releases
Platform
Version
Windows 10
21H2 (arm64, x64, x86)
22H2 (arm64, x64, x86)
Windows 11
23H2 (arm64, x64)
24H2 (arm64, x64)
25H2 (arm64, x64)
26H1 (arm64, x64)
Windows Server 2022
Server Core
Standard
Windows Server 2025
Server Core
Standard