CVE-2026-83504: Windows SmartScreen Information Disclosure Vulnerability
Time-of-check time-of-use (toctou) race condition in Windows SmartScreen allows an authorized attacker to disclose information locally.
Other sources
Windows SmartScreen Information Disclosure Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.22631.7582Patch KB5122880 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.9445Patch KB5124008 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26200.9445Patch KB5124008 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.28000.2954Patch KB5124012
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running Microsoft Windows 11 with Windows SmartScreen are in scope. Exploitation is local rather than network-based.
What access does an attacker need?
An attacker must already be authorized on the affected system and have low-level privileges. The attack also requires overcoming high attack complexity conditions, and does not require user interaction.
What is the likely impact if exploitation succeeds?
Successful exploitation can disclose information. The provided severity data indicates no integrity or availability impact.
How can I determine whether a system is affected?
Identify Windows 11 systems that use Microsoft Windows SmartScreen, then consult the referenced Microsoft security advisory for CVE-2026-83504.