CVE-2026-45604 Overview
CVE-2026-45604 is an out-of-bounds read vulnerability [CWE-125] in the Windows Application Identity (AppID) Subsystem. An authorized local attacker can exploit the flaw to read memory outside the bounds of an allocated buffer, leading to local information disclosure.
Exploitation requires local access and low-privilege authentication on the target system. The vulnerability impacts confidentiality but does not affect integrity or availability. No user interaction is required to trigger the condition.
Critical Impact
An authenticated local attacker can disclose sensitive memory contents from the AppID subsystem, potentially exposing data useful for further privilege escalation or lateral movement.
Affected Products
- Microsoft Windows (Application Identity Subsystem) — refer to the Microsoft Security Update CVE-2026-45604 advisory for the full list of affected builds
- Windows client editions running the AppID service
- Windows Server editions running the AppID service
Discovery Timeline
- 2026-06-09 - CVE-2026-45604 published to NVD
- 2026-06-09 - Last updated in NVD database
Technical Details for CVE-2026-45604
Vulnerability Analysis
The Windows Application Identity (AppID) Subsystem manages application identification used by AppLocker and related policy enforcement components. The subsystem evaluates file metadata, publisher signatures, and rule conditions to determine whether an executable, script, or installer is permitted to run.
CVE-2026-45604 is an out-of-bounds read condition within this subsystem. When AppID processes a crafted input, it reads beyond the allocated buffer boundary. The adjacent memory contents are returned through the affected code path, exposing data that should remain inaccessible to the caller.
The disclosed memory may contain pointers, handles, policy structures, or fragments of other process data resident in shared memory regions. Attackers can use this information to defeat memory layout randomization or to stage subsequent attacks against higher-privileged components.
Root Cause
The root cause is missing or incorrect bounds validation prior to a read operation in the AppID code path. Software classified under [CWE-125] reads memory using an index or pointer that exceeds the buffer's allocated size. In this case, the AppID subsystem trusts a length or offset value without verifying it against the actual buffer extent.
Attack Vector
The attack vector is local. An attacker must already hold low-privilege credentials on the target host, either through interactive logon, a foothold from prior compromise, or execution under a service account. The attacker issues requests to the AppID subsystem that trigger the vulnerable read path and harvests the returned data.
The vulnerability mechanism is described in prose because no verified proof-of-concept code is publicly available. See the Microsoft Security Update CVE-2026-45604 advisory for vendor-supplied technical context.
Detection Methods for CVE-2026-45604
Indicators of Compromise
- Unexpected interactions with the AppIDSvc service from low-privileged user contexts
- Abnormal volume of AppLocker or AppID policy evaluation requests originating from a single process
- Local processes repeatedly invoking AppID APIs with malformed or unusual input parameters
Detection Strategies
- Monitor process creation and API call telemetry for non-administrative processes interacting with the AppID subsystem outside of expected application launch workflows
- Correlate AppID service activity with subsequent attempts to enumerate sensitive system resources, which may indicate post-disclosure reconnaissance
- Baseline normal AppLocker policy evaluation patterns and alert on statistical deviations from individual user sessions
Monitoring Recommendations
- Enable detailed Windows event logging for AppLocker (Microsoft-Windows-AppLocker) and AppID-related channels
- Forward endpoint telemetry to a centralized analytics platform to detect cross-host patterns of AppID abuse
- Track local privilege escalation attempts that follow information-gathering activity against the AppID service
How to Mitigate CVE-2026-45604
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-45604 advisory across all affected Windows systems
- Prioritize patching on multi-user systems, terminal servers, and jump hosts where local low-privileged accounts are common
- Audit local account inventories and remove unnecessary interactive logon rights
Patch Information
Microsoft has issued a security update for CVE-2026-45604. Administrators should obtain the relevant package from the Microsoft Security Update CVE-2026-45604 guide and deploy it through Windows Update, Windows Server Update Services (WSUS), Microsoft Intune, or equivalent patch management tooling.
Workarounds
- No vendor-supplied workaround is documented; apply the official patch as the primary remediation
- Restrict local logon rights and limit which accounts can execute code on sensitive hosts to reduce the population of users who can exploit the issue
- Enforce least-privilege policies and monitor service interactions until patching is complete
# Verify patch deployment status on Windows hosts
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20
# Confirm the Application Identity service state
Get-Service -Name AppIDSvc | Format-List Name, Status, StartType
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
