CVE-2026-83905

CVE-2026-83905 is a Windows Shell information disclosure vulnerability that was addressed by Microsoft during its October 2026 Patch Tuesday release. The flaw is associated with CWE-497, which involves the exposure of sensitive system information to an unauthorized control sphere. To exploit this vulnerability, an attacker must already have local access to the target machine and be authenticated with basic user privileges. A successful exploit allows the authorized local attacker to view and disclose sensitive system data that should otherwise be restricted. The vulnerability affects numerous versions of the Windows operating system, including Windows 10, Windows 11, and various Windows Server editions. At the time of its disclosure, there were no reports of the vulnerability being actively exploited in the wild, nor were there any public proof-of-concept exploits available. Microsoft has released security updates to resolve the issue, and system administrators are advised to apply these patches to mitigate the risk of unauthorized information disclosure.