CVE-2026-61360

Windows sometimes keeps parts of its “working memory” while it’s running. This vulnerability can let a logged-in, low-privileged user trick Windows into looking at the wrong memory locations, which can expose sensitive information already sitting in the system’s memory.

This matters if your business runs the affected Windows versions (Windows 10/11 and Windows Server 2012/2012 R2/2016/2019/2022/2025). The key risk is for situations where someone who is not fully trusted can log into the machine (for example, shared computers, contractor accounts, or weak account controls). This is only a risk when an attacker has a valid low-privileged user account on the system (it is not about someone breaking in from the network without credentials).

This is RED because it’s a real, authenticated local disclosure flaw: if an attacker can log in with low privileges, they can potentially pull sensitive data from memory. Even though it’s not known to be exploited in the public reporting you have here, it’s still the kind of issue that becomes dangerous in the presence of untrusted or compromised user accounts, so patching should be prioritized immediately.

1. Confirm exposure (quick check)
   • For each affected machine, record the exact Windows version/build number.
   • On Windows, run winver and note the “Version” and build/revision.
2. Determine whether the machine is vulnerable
   • Compare your build/revision to Microsoft’s fixed versions for CVE-2026-61360 (from the Microsoft update guide).
   • If your build/revision is earlier than the fixed revision for your OS branch, treat the system as exposed.
3. Upgrade to the fixed versions
   • Windows 10 (multiple branches) must be updated to one of the fixed revisions:
     • 10.0.14393.9418
     • 10.0.17763.9121
     • 10.0.19044.7663
     • 10.0.19045.7663
   • Windows 11 (multiple branches) must be updated to one of the fixed revisions:
     • 10.0.22631.7517
     • 10.0.26100.9168
     • 10.0.26200.9168
     • 10.0.28000.2704
   • Windows Server must be updated to one of these fixed revisions:
     • Windows Server 2012: 6.2.9200.26280
     • Windows Server 2012 R2: 6.3.9600.23338
     • Windows Server 2016: 10.0.14393.9418
     • Windows Server 2019: 10.0.17763.9121
   • Follow Microsoft’s standard update process for your Windows servicing branch (Windows Update, WSUS, or your patch management tool).
4. Temporary workaround if patching is delayed
   • Reduce who can log in locally or interactively:
     • Remove unused accounts.
     • Ensure contractor/shared access uses separate accounts with minimal permissions.
     • Enforce strong authentication and disable unnecessary interactive access.
   • This matters because the vulnerability requires an attacker to already have a valid low-privileged user account.
5. What to monitor after patching
   • Verify successful patch installation and that machines reboot into the expected build/revision.
   • If you suspect account compromise, prioritize account review (logins, unusual sessions) because the attacker model here assumes an authenticated user.

Severity/impact: Medium (CVSS 5.5), but it can still be damaging because it allows reading confidential memory content locally. Weakness type is CWE-822 (Untrusted Pointer Dereference). Mechanism (from findings/backstop): a local, authenticated attacker can trigger a flaw in Windows handling of graphics data pointers, causing Windows to read memory locations it should not access, enabling disclosure without needing code execution. Attack vector and prerequisites: requires a valid low-privileged user account on the target; no user interaction is required. Exploit status: there is no KEV entry and no public exploit code noted in the provided findings; press reporting does not include a clear dated exploitation claim. There is an actor/press mention (Lazarus group) in PULSE, but exploitation is not confirmed in the provided findings. Prediction (EPSS) is provided in the findings as 0.4% with a flat trend; per instructions, public blocks do not emphasize this because KEV/news would override—no KEV is listed here.