CVE-2026-70145 in Windows
Summary
by MITRE • 09/09/2026
Out-of-bounds read in Microsoft Windows Search Component allows an authorized attacker to disclose information locally.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as an out-of-bounds read within the Microsoft Windows Search component represents a critical memory safety flaw that compromises the confidentiality of data on affected systems. This specific type of error occurs when software attempts to access memory locations outside the intended buffer boundaries, typically reading past the end of an allocated array or structure. In this context, the Windows Search service, which is responsible for indexing and querying files and content within a user's environment, processes input that triggers this improper boundary check. Because the flaw resides in a core system component with elevated privileges relative to standard applications, it presents a significant risk vector for local information disclosure attacks.
From a technical perspective, out-of-bounds reads are classified under CWE-125, which denotes an error where software reads memory past the end of a buffer or array. Unlike write operations that can lead to code execution and full system compromise, read vulnerabilities primarily affect confidentiality rather than integrity or availability. However, they remain dangerous because they allow attackers to extract sensitive data from the process's virtual address space. This could include cryptographic keys, session tokens, passwords stored in memory by other applications, or proprietary source code fragments if such processes are running concurrently with the search service. The attacker does not need to execute arbitrary code but merely needs to trigger the specific condition that causes the out-of-bounds access and then interpret the returned data.
The operational impact of this vulnerability is centered on unauthorized information disclosure by an authorized user. Since exploitation requires local access, a threat actor must first gain authenticated entry into the system through social engineering, stolen credentials, or other initial access vectors. Once inside, they can craft specific inputs to the Windows Search API that cause it to read from unintended memory regions. The disclosed data is then returned to the attacker's process, enabling further reconnaissance or lateral movement within a network environment. This aligns with MITRE ATT&CK technique T1005, which covers Data from Local System, specifically sub-techniques related to application program interfaces and file and directory discovery that leverage memory contents rather than direct file system access.
Mitigation strategies for this vulnerability primarily involve the deployment of official security patches released by Microsoft. Organizations should prioritize applying updates to all Windows endpoints running affected versions of the operating system. In environments where patching is not immediately feasible, network segmentation can help limit the blast radius if an attacker gains initial foothold. Additionally, enforcing strict least-privilege policies ensures that even if a user account is compromised, their ability to interact with sensitive services like Windows Search is minimized through application control and restricted token configurations. Monitoring for unusual memory access patterns or anomalies in search service behavior can also aid in detecting potential exploitation attempts before significant data exfiltration occurs.