Description

Weak authentication in Microsoft Windows Search Component allows an authorized attacker to disclose information locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-11T17:18:07.980Z",
  "pubdate": "2026-08-11T17:18:07.980Z",
  "executiveSummary": "This vulnerability involves a weak authentication flaw within the Microsoft Windows Search Component, specifically enabling local information disclosure.\nThe security defect allows an authorized threat actor to extract sensitive data from the underlying operating system through improper handling of authentication mechanisms.\nThe affected product is the Microsoft Windows Search Component across supported architectures.\nThe primary risk implication is the unauthorized extraction of local information, which may expose sensitive user or system data to malicious actors.\nAttacker capabilities are strictly confined to local access vectors, requiring the adversary to possess prior authorization on the target machine.\nExploitation requirements dictate that the attacker must already be authenticated locally to interact with the vulnerable component and trigger the information disclosure vector.",
  "technicalDetails": "The vulnerability resides within the Microsoft Windows Search Component due to weak authentication enforcement during internal processing routines and local IPC (Inter-Process Communication) handlers.\nThe root cause stems from inadequate validation of security contexts and access control lists (ACLs) when handling queries or requests within the search indexing architecture.\nThe affected component is the Microsoft Windows Search Component, which processes system queries and indexes local file systems.\nThe attack flow proceeds as follows: First, an authorized local attacker establishes a session on the target system. Second, the adversary crafts a specialized query or interaction targeting the vulnerable search component interface. Third, due to the weak authentication mechanisms in place, the component fails to properly validate the caller's privilege boundaries or session constraints. Finally, the component returns requested indexed data or metadata that the user should normally be restricted from accessing, resulting in unauthorized local information disclosure.\nAuthentication requirements dictate that the attacker must be authorized on the local host to interact with the system interface.\nPrivilege requirements are minimal, as standard authorized users can typically trigger the vulnerable code path.\nNetwork exposure is non-existent, as the vulnerability is strictly local and cannot be exploited remotely.\nThe post-exploitation impact is limited to local information disclosure, potentially exposing confidential files, metadata, or system configuration details indexed by the search service."
}