Microsoft Patches Windows SCSI Driver Flaw That Can Expose Kernel Memory

Microsoft released an official fix for CVE-2026-113821, an information disclosure vulnerability in the Windows SCSI Class System File. A highly privileged local attacker could exploit the flaw to read kernel memory from a user-mode process without user interaction. Microsoft rates the vulnerability Important, with a CVSS v3.1 base score of 4.1, and describes exploitation as highly complex. At its November 10 disclosure, Microsoft reported no public disclosure or observed exploitation and assessed exploitation as unlikely.

The flaw is a CWE-126 buffer over-read, in which software reads beyond an intended buffer boundary. MITRE notes that this weakness class can expose sensitive memory, potentially including information useful for bypassing protections such as ASLR; those additional consequences were not specifically established for this vulnerability in the supplied advisory. Organizations should deploy Microsoft's applicable security update through normal patch management, weighing the kernel-memory exposure against the vulnerability's high privilege requirement and exploitation complexity.