Product:
Windows Remote Procedure Call
Summary
The vulnerability allows unauthorized actors to access sensitive information through Windows Remote Procedure Call. This exposure can lead to the disclosure of information locally. Attackers can exploit this vulnerability without requiring any privileges or user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.2 | CVE-2026-20821 |
Exploitation
To exploit this vulnerability, an attacker must have local access to the system where Windows Remote Procedure Call is running. By leveraging this access, the attacker can execute specific commands or scripts that trigger the information disclosure, allowing them to retrieve sensitive data stored on the system.
Affected Products
- Windows Remote Procedure Call: Vulnerable to unauthorized information disclosure due to improper handling of sensitive data.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security updates provided by Microsoft. Additionally, restricting local access to systems running Windows Remote Procedure Call can help reduce the risk of exploitation.