Medium · 6.2 CVE-2026-20851 EUVD-2026-2177GHSA-5x4x-63j4-7rhv

Capability Access Management Service (camsvc) Information Disclosure Vulnerability

Published Jan 13, 2026 · Updated Jul 30, 2026 · Assigned by microsoft

Vendor: Microsoft Product: Windows 11 Version 24H2 Product: Windows 11 Version 25H2 Product: Windows Server 2025 Product: Windows Server 2025 (Server Core installation) Platform: Windows

Description

Out-of-bounds read in Capability Access Management Service (camsvc) allows an unauthorized attacker to disclose information locally.

Affected products

Vendor	Product	Affected	Fixed
Microsoft	Windows 11 Version 24H2	10.0.26100.0 – < 10.0.26100.7623	10.0.26100.7623
Microsoft	Windows 11 Version 25H2	10.0.26200.0 – < 10.0.26200.7623	10.0.26200.7623
Microsoft	Windows Server 2025	10.0.26100.0 – < 10.0.26100.32230	10.0.26100.32230
Microsoft	Windows Server 2025 (Server Core installation)	10.0.26100.0 – < 10.0.26100.32230	10.0.26100.32230

Advisories 3

NCSC-2026-0007 Kwetsbaarheden verholpen in Microsoft Windows NCSC-NL (Netherlands) · Apr 10, 2026
WID-SEC-2026-0083 Microsoft Windows : Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 2, 2026
MSRC-CVE-2026-20851 Capability Access Management Service (camsvc) Information Disclosure Vulnerability Microsoft Security Response Center · Jan 13, 2026

References

Capability Access Management Service (camsvc) Information Disclosure Vulnerability vendor-advisory patch