CVE-2026-70145: Windows Search Information Disclosure Flaw

CVE-2026-70145 Overview

CVE-2026-70145 is an out-of-bounds read vulnerability [CWE-125] in the Microsoft Windows Search Component. An authorized local attacker can exploit the flaw to read memory outside allocated buffers, resulting in local information disclosure. The Windows Search Component indexes files, email, and other content across the operating system, giving the flaw broad reach on affected systems.

Exploitation requires local access and low-level privileges, and no user interaction is needed. The impact is limited to confidentiality; integrity and availability are not affected.

Critical Impact
An authenticated local attacker can disclose sensitive process memory contents from the Windows Search Component, potentially exposing indexed data, credentials, or other information residing in the affected process address space.

Affected Products

Microsoft Windows (Windows Search Component)
Refer to the Microsoft Security Update Guide for the authoritative list of affected Windows versions and builds

Discovery Timeline

2026-09-08 - CVE-2026-70145 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-70145

Vulnerability Analysis

The vulnerability resides in the Windows Search Component, which indexes and searches content across the local system. An out-of-bounds read occurs when the component reads memory beyond the end of, or before the beginning of, an allocated buffer. The attack is local and requires the attacker to already hold a valid account on the system.

Because exploitation only impacts confidentiality, the primary risk is leakage of process memory content. Leaked bytes may contain fragments of indexed data, file paths, tokens, or other sensitive material handled by the Search service. Repeated invocation can allow an attacker to accumulate memory fragments over time.

Root Cause

The root cause is a missing or insufficient bounds check when the Windows Search Component processes attacker-influenced input, mapped by MITRE to [CWE-125] Out-of-bounds Read. The affected code path dereferences memory using an index or pointer that is not properly validated against the size of the underlying buffer. Microsoft has not published low-level technical details; see the Microsoft Security Update Guide for the vendor advisory.

Attack Vector

Exploitation requires local access to the target system and a low-privileged authenticated context. The attacker interacts with the Windows Search Component through a supported input path such as a crafted query, indexed item, or interprocess call. No user interaction is required, and the scope is unchanged, meaning the impact stays within the security boundary of the affected process.

No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported at the time of publication, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-70145

Indicators of Compromise

No vendor- or community-published indicators of compromise are available for CVE-2026-70145 at the time of writing.
Monitor the Microsoft Security Update Guide for updated detection guidance.

Detection Strategies

Audit local process activity targeting SearchIndexer.exe and related Windows Search Component binaries for unusual query patterns or repeated crashes.
Correlate anomalous local logons or session activity with subsequent interaction with the Search service, which may indicate reconnaissance or exploitation attempts.
Track Windows Error Reporting (WER) and application crash events tied to the Windows Search Component, as out-of-bounds reads can produce faults during unsuccessful exploitation.

Monitoring Recommendations

Forward Windows security, application, and Sysmon event logs to a centralized analytics platform for behavioral analysis of the Search service.
Alert on unexpected child processes spawned by, or handle access to, the Search Component from non-administrative user contexts.
Baseline normal query rates and resource use for SearchIndexer.exe and generate alerts on statistically significant deviations.

How to Mitigate CVE-2026-70145

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide as soon as it is available for your Windows build.
Inventory Windows endpoints and servers to identify systems running the Windows Search service and prioritize patching multi-user hosts such as Remote Desktop Services servers.
Restrict interactive and remote local logon rights to only necessary users to reduce the population able to reach the local attack surface.

Patch Information

Microsoft has issued guidance and updates through the Microsoft Security Update Guide. Administrators should consult the advisory to identify the correct security update for each supported Windows version and deploy it through Windows Update, Windows Server Update Services (WSUS), Microsoft Intune, or an equivalent patch management platform.

Workarounds

No official vendor workaround is documented; installing the security update is the supported remediation.
Where patching must be delayed, limit local account access on affected systems and enforce least privilege to reduce the number of users able to exploit the local attack vector.
Disable the Windows Search service only after validating operational impact, since indexing and search functionality across the OS and Microsoft Outlook depend on it.

bash

# Query Windows Search service status on a target host (PowerShell)
Get-Service -Name WSearch | Select-Object Status, StartType, DisplayName

# Verify installed security updates against the KB listed in the Microsoft advisory
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20