CVE-2026-45604 - Windows Managed Installer Information Disclosure Vulnerability

MEDIUM

Windows Managed Installer Information Disclosure Vulnerability

Published Jun 9, 2026

5.5

MEDIUM

CVSS 3.1

EPSS 0.40%

Out-of-bounds read in Windows Application Identity (AppID) Subsystem allows an authorized attacker to disclose information locally.

Vendor Microsoft Product Windows 11 Version 23H2 Default
unknown
Affected
- ≥ 10.0.22631.0, < 10.0.22631.7219
Vendor Microsoft Product Windows 11 Version 24H2 Default
unknown
Affected
- ≥ 10.0.26100.0, < 10.0.26100.8655
Vendor Microsoft Product Windows 11 Version 25H2 Default
unknown
Affected
- ≥ 10.0.26200.0, < 10.0.26200.8655
Vendor Microsoft Product Windows 11 version 23H2 Default
unknown
Affected
- ≥ 10.0.22631.0, < 10.0.22631.7219
Vendor Microsoft Product Windows 11 version 26H1 Default
unknown
Affected
- ≥ 10.0.28000.0, < 10.0.28000.2269
Vendor Microsoft Product Windows Server 2025 Default
unknown
Affected
- ≥ 10.0.26100.0, < 10.0.26100.32995
Vendor Microsoft Product Windows Server 2025 (Server Core installation) Default
unknown
Affected
- ≥ 10.0.26100.0, < 10.0.26100.32995

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Microsoft	Windows 11 Version 23H2	unknown	Affected ≥ 10.0.22631.0, < 10.0.22631.7219
Microsoft	Windows 11 Version 24H2	unknown	Affected ≥ 10.0.26100.0, < 10.0.26100.8655
Microsoft	Windows 11 Version 25H2	unknown	Affected ≥ 10.0.26200.0, < 10.0.26200.8655
Microsoft	Windows 11 version 23H2	unknown	Affected ≥ 10.0.22631.0, < 10.0.22631.7219
Microsoft	Windows 11 version 26H1	unknown	Affected ≥ 10.0.28000.0, < 10.0.28000.2269
Microsoft	Windows Server 2025	unknown	Affected ≥ 10.0.26100.0, < 10.0.26100.32995
Microsoft	Windows Server 2025 (Server Core installation)	unknown	Affected ≥ 10.0.26100.0, < 10.0.26100.32995

No remediation recorded yet.

Weaknesses (1)

CWE-125

Out-of-bounds Read

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-35553		Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45604		vendor-advisorypatchVendor Advisory

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner microsoft

Published Jun 9, 2026

Updated Sep 24, 2026

Reserved May 12, 2026

CISA Vulnrichment

Updated Jun 10, 2026

NVD

Status Analyzed

Modified Jul 23, 2026

Red Hat

No data

ENISA EUVD

Assigner microsoft

Published Jun 9, 2026

Updated Sep 24, 2026

GitHub

No data