CVE-2026-83849: Windows Hello Information Disclosure Vulnerability
Out-of-bounds read in Windows Hello allows an authorized attacker to disclose information locally.
Other sources
Windows Hello Information Disclosure Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.19044.7807Patch KB5126657 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.9711Patch KB5127648 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26300.9711Patch KB5127648 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.28000.3231Patch KB5127646 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26200.9711Patch KB5127648 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.22631.7652Patch KB5126653
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must already be authorized on the affected Windows system and have local access. The vulnerability affects Microsoft Windows 10 and Microsoft Windows 11.
What is the security impact?
Successful exploitation can disclose information from the affected system. The available data does not indicate an integrity or availability impact.
Does exploitation require user interaction or elevated privileges?
No user interaction is required. The attacker needs low privileges, as indicated by the PR:L vector.