Numeric Truncation Error in Internet Storage Name Service

Publication date: 2026-09-08

Last updated on: 2026-09-24

Assigner: Microsoft Corporation

Description

Numeric truncation error in Internet Storage Name Service allows an authorized attacker to disclose information locally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-24

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-68895

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	internet_storage_name_service	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-197	Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.

Attack-Flow Graph

Executive Summary

This vulnerability is a numeric truncation error in the Internet Storage Name Service. It allows an authorized attacker to disclose information locally by exploiting the truncation issue.

Impact Analysis

An authorized attacker could exploit this to access sensitive information stored locally on a system running the affected Internet Storage Name Service.

Mitigation Strategies

Apply the latest security updates from Microsoft for Internet Storage Name Service. Restrict local access to authorized users only and monitor for unusual activity.

Hi! I’m here to help you understand CVE-2026-68895. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70