Executive brief
Windows Task Scheduler is a core operating system component that manages automated task execution on Windows systems. A use-of-uninitialized-resource vulnerability allows an authorized local attacker to read sensitive information from system memory, potentially exposing credentials or other confidential data stored during task processing.
Technical details
This vulnerability is a use-of-uninitialized-resource flaw in the Windows Task Scheduler component. An attacker with local system access can trigger the scheduler to use uninitialized memory regions, allowing disclosure of previously stored sensitive data. The attack requires local authentication/authorization to execute, and does not require network access or privilege escalation to initiate. Successful exploitation results in information disclosure only (not code execution or availability impact). Microsoft has released security patches to initialize resources properly before use.
Affected products
- Microsoft Windows <UNKNOWN>
Timeline
- 2026-09-08: disclosed