CVE-2026-69294

Awaiting Analysis Awaiting Analysis - Queue

Microsoft COM for Windows Information Disclosure

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: Microsoft Corporation

Description

Generation of error message containing sensitive information in Microsoft COM for Windows allows an authorized attacker to disclose information locally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-69294

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	com	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-209	The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

Executive Summary

This vulnerability involves Microsoft COM for Windows generating error messages that may contain sensitive information. An authorized attacker could exploit this to locally disclose confidential data.

Impact Analysis

An attacker with local access could obtain sensitive information from error messages, potentially leading to further attacks or data breaches. The impact is limited to local disclosure as remote exploitation is not indicated.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of personal or sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality.

Mitigation Strategies

Apply the latest security updates from Microsoft to address the COM for Windows vulnerability. Monitor Microsoft's security advisories for patches and install them promptly. Restrict local access to authorized users only and review system logs for suspicious activity.

Hi! I’m here to help you understand CVE-2026-69294. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70