CVE-2026-61360

Windows sometimes keeps parts of its “working memory” while it’s running. This vulnerability can let a logged-in, low-privileged user trick Windows into looking at the wrong memory locations, which can expose sensitive information already sitting in the system’s memory.

This matters if your business runs the affected Windows versions (Windows 10/11 and Windows Server 2012/2012 R2/2016/2019/2022/2025). The key risk is for situations where someone who is not fully trusted can log into the machine (for example, shared computers, contractor accounts, or weak account controls). This is only a risk when an attacker has a valid low-privileged user account on the system (it is not about someone breaking in from the network without credentials).

This is RED because it’s a real, authenticated local disclosure flaw: if an attacker can log in with low privileges, they can potentially pull sensitive data from memory. Even though it’s not known to be exploited in the public reporting you have here, it’s still the kind of issue that becomes dangerous in the presence of untrusted or compromised user accounts, so patching should be prioritized immediately.