Observable discrepancy in Microsoft Windows and Windows Server - CVE-2026-59131

Vulnerability details

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a cryptographic side-channel weakness in AMD Zen when decrypting attacker-modified encrypted secrets using specific old cryptography and Windows APIs. A local user can modify a stored encrypted secret and observe precise decryption timing across many attempts to disclose sensitive information.

Exploitation requires the ability to persist encrypted secrets and relies on repeated decryption attempts to infer the original secret.

Affected software

How to mitigate CVE-2026-59131

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-59131
• https://support.microsoft.com/help/5120238

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Windows