---
id: "CVE-2026-105584"
page: "https://infrastack.ai/live/CVE-2026-105584"
kind: "vulnerability"
aliases: ["CVE-2026-105584"]
title: "Windows Inventory Backup: format string flaw lets a local user disclose information"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows Inventory Backup", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["infrastructure", "windows"]
not_affected_if: ["no-local-accounts"]
published_at: "2026-11-10T19:18:01+00:00"
first_seen_at: "2026-11-10T19:24:21+00:00"
updated_at: "2026-11-10T20:02:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105584", "first_seen_at": "2026-11-10T19:24:21+00:00"}]
exploit_sources: []
---

# Windows Inventory Backup: format string flaw lets a local user disclose information

Link for people: https://infrastack.ai/live/CVE-2026-105584 (this .md is for agents)

A format string flaw in the Windows Inventory Backup component lets an authorized attacker read information they should not see, on the same machine. The sources do not say what data is exposed or which Windows versions are affected.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows Inventory Backup affected range not listed fixed no fixed version listed

## Timeline

- 2026-11-10T19:24:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105584

## From the sources

Use of externally-controlled format string in Windows Inventory Backup allows an authorized attacker to disclose information locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_