CVE-2026-69919ImportantInformation DisclosureLocal

Windows Cryptographic Services Information Disclosure Vulnerability

MSRC advisory NVD CVE.org

Assessment

Out-of-bounds read in Windows Cryptographic Services allows an authorized attacker to disclose information locally.

Severity: Important
CVSS base score: 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Impact: Information Disclosure
EPSS, next 30 days: Not scored yet
Public exploit code: No Nuclei template lists it
Exploitability: Exploitation Less Likely
Publicly disclosed: No
Customer action: Required: apply the update
Component: Windows Cryptographic Services
Weakness: CWE-125: Out-of-bounds Read
Issued by: Microsoft
Published: 13 Oct 2026 · October 2026
Last revised: 13 Oct 2026

CVSS 3.1 base metricsRed raises the risk · green lowers it

Attack vector: LocalAV:L
Attack complexity: LowAC:L
Privileges required: LowPR:L
User interaction: NoneUI:N
Scope: UnchangedS:U
Confidentiality: HighC:H
Integrity: NoneI:N
Availability: NoneA:N

Updates that fix it

3 KBs

KB	Type	Restart	Applies to	Other CVEs
KB5126646	Security Update	Required	Windows Server 2025, Windows Server 2025 (Server Core installation)	All CVEs in KB5126646
KB5127646	Security Update	Required	Windows 11 Version 26H1 for ARM64-based Systems, Windows 11 version 26H1 for x64-based Systems	All CVEs in KB5127646
KB5127648	Security Update	Required	Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems, Windows 11 Version 25H2 for ARM64-based Systems and 3 more	All CVEs in KB5127648

Affected products

Windows

10 affected products

What changed

First observed 14 Oct 2026

No field changes in the recorded history.

Cite this recorded revision to keep the same title, summary, facts and links when the page changes.

A day selects the latest observation by the end of that UTC day; today's selection can change until midnight. History starts when this installation records it.