Executive brief
Windows Management Instrumentation (WMI) is a core Windows component that allows administrators and applications to manage and monitor system resources. This vulnerability allows an authorized attacker to read uninitialized memory through WMI, potentially exposing sensitive system information such as credentials, keys, or other data that may have been left in memory by other processes.
Technical details
This vulnerability involves the use of uninitialized memory in Windows Management Instrumentation, a classic information disclosure issue. An authorized attacker with local network access to WMI can craft requests that cause uninitialized data structures to be returned, leading to information disclosure. The attack requires existing credentials or authorization to access WMI services. The vulnerability allows an attacker to read sensitive data from memory without code execution or privilege escalation capabilities. Microsoft has released security updates to properly initialize memory structures before use.
Affected products
- Microsoft Windows Management Instrumentation
Timeline
- 2026-09-08: disclosed