CVE-2026-83504

Awaiting Analysis Awaiting Analysis - Queue

Windows SmartScreen TOCTOU Race Condition Information Disclosure

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: Microsoft Corporation

Description

Time-of-check time-of-use (toctou) race condition in Windows SmartScreen allows an authorized attacker to disclose information locally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-83504

EUVD

EUVD-2026-99293

Affected Vendors & Products

Vendor	Product	Version / Range
Microsoft	Windows	11 version 23H2 10.0.22631.0
Microsoft	Windows	11 Version 23H2 10.0.22631.0
Microsoft	Windows	11 Version 24H2 10.0.26100.0
Microsoft	Windows	11 Version 25H2 10.0.26200.0
Microsoft	Windows	11 version 26H1 10.0.28000.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

Executive Summary

This is a time-of-check time-of-use (TOCTOU) race condition in Windows SmartScreen. It allows an authorized attacker to exploit a timing issue to disclose information locally on a system.

Detection Guidance

This vulnerability is a local Windows SmartScreen race condition. Detection requires monitoring for unusual SmartScreen activity or unauthorized information access attempts. Use Windows Event Viewer to check for SmartScreen-related errors or logs indicating unexpected file access patterns.

Impact Analysis

An attacker with local access could exploit this flaw to read sensitive information from the system, potentially leading to unauthorized data exposure or further attacks.

Mitigation Strategies

Apply the latest Windows security updates from Microsoft Update to patch the SmartScreen race condition.
Monitor for unusual SmartScreen-related activity in Windows Event Viewer logs.
Restrict local user permissions where possible to limit unauthorized access attempts.

Hi! I’m here to help you understand CVE-2026-83504. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70