CVE-2026-70141: Windows Search Component Info Disclosure

CVE-2026-70141 Overview

CVE-2026-70141 is an out-of-bounds read vulnerability [CWE-125] in the Microsoft Windows Search Component. An authorized local attacker can exploit the flaw to read memory outside the intended buffer boundaries and disclose sensitive information. Exploitation requires local access and low-level privileges, with no user interaction needed.

The vulnerability affects the confidentiality of the host but does not permit modification of data or disruption of service. Microsoft published the advisory on 2026-10-13, and no public proof-of-concept or in-the-wild exploitation has been reported.

Critical Impact

An authenticated local attacker can read adjacent memory contents from the Windows Search Component, potentially exposing sensitive data processed by the indexing service.

Affected Products

• Microsoft Windows (Windows Search Component)
• Specific Windows versions and build numbers are listed in the Microsoft Vulnerability Advisory CVE-2026-70141
• Refer to the MSRC guide for the complete affected build matrix

Discovery Timeline

• 2026-10-13 - CVE-2026-70141 published to the National Vulnerability Database
• 2026-10-13 - Last updated in NVD database (modified 2026-10-13T22:18:10)

Technical Details for CVE-2026-70141

Vulnerability Analysis

The Windows Search Component indexes files, email, and other content to support fast search queries across the operating system. The service parses structured data and runs under elevated privileges on the local host. An out-of-bounds read occurs when the component reads data past the end of an allocated buffer during this parsing or query handling.

The flaw results in information disclosure rather than code execution. Memory adjacent to the intended buffer may contain data from other operations handled by the Search service, including fragments of indexed documents or in-process state. An attacker with a valid local account on the target machine can trigger the condition and recover those bytes.

The attack is strictly local. Network-based exploitation is not possible based on the advisory data, and no user interaction is required to trigger the read once the attacker is authenticated.

Root Cause

The root cause is classified as CWE-125: Out-of-bounds Read. The Windows Search Component fails to validate that a read operation stays within the bounds of its source buffer. Insufficient length checks or incorrect index calculations allow the service to return memory contents from outside the intended region.

Attack Vector

The attack vector is local and requires existing authentication on the target system. An attacker invokes the vulnerable Search Component code path with crafted input that drives the service to perform an unchecked read. The disclosed memory is returned to the attacker-controlled context, where it can be collected and analyzed for sensitive data such as cached credentials, document content, or application state.

No verified exploitation code is publicly available for CVE-2026-70141. For protocol-level details, review the Microsoft Vulnerability Advisory CVE-2026-70141.

Detection Methods for CVE-2026-70141

Indicators of Compromise

• No public indicators of compromise have been published for CVE-2026-70141 at this time.
• Unexpected crashes, hangs, or Watson error reports for SearchIndexer.exe or SearchProtocolHost.exe may indicate probing activity.
• Repeated or anomalous queries submitted to the Windows Search service from non-interactive user sessions warrant review.

Detection Strategies

• Monitor process telemetry for abnormal child processes, memory access patterns, or crashes involving the Windows Search Component.
• Correlate local logon events with sudden spikes in Search Component activity initiated by low-privilege accounts.
• Baseline normal Search Indexer behavior per host and alert on statistically significant deviations.

Monitoring Recommendations

• Enable Windows Error Reporting and forward crash telemetry for SearchIndexer.exe to a central log pipeline.
• Ingest Sysmon process and image-load events for the Search Component into your SIEM for retrospective hunts.
• Track patch deployment status across the fleet and alert on hosts missing the October 2026 Microsoft update.

How to Mitigate CVE-2026-70141

Immediate Actions Required

• Apply the Microsoft security update for CVE-2026-70141 as published in the Microsoft Vulnerability Advisory.
• Prioritize patching on multi-user systems, shared workstations, and Remote Desktop Session Hosts where local accounts are abundant.
• Audit local account inventories and remove or disable accounts that are not required.

Patch Information

Microsoft released a security update addressing CVE-2026-70141 on 2026-10-13. Consult the official Microsoft Vulnerability Advisory CVE-2026-70141 for the exact KB article, affected build numbers, and installation guidance for each supported Windows release.

Workarounds

• No official workaround has been published. Patching is the recommended remediation.
• As a defense-in-depth measure, restrict interactive and remote local logon rights to trusted administrative accounts.
• Consider disabling the Windows Search service on hosts where indexing is not required, understanding the impact on search functionality.

# Verify the Windows Search service status on a target host
sc query wsearch

# Disable the Windows Search service if not required (defense-in-depth only)
sc config wsearch start= disabled
net stop wsearch