Summary

When switching users via alt+ctrl+delete, the braille display is not refreshed. This could leak privileged information.

• Vulnerability class: Physical access
• Impact: Confidentiality loss

Patch commit(s)

0689e2158

Limitations

• The user must be using NVDA with a refreshable braille display.

Technical details

Since braille displays typically "lock" their pins in place, it is necessary to refresh the display in order to stop them displaying the last sent output. If this is not done when switching from a privileged to an unprivileged context, privilaged information may be leaked.

Proof of concept

1. Open Notepad and type any sensitive text, e.g., "Secret code is 12345".
2. Ensure a braille device is connected and active with NVDA displaying the text.
3. Press control+alt+delete and select "Change user"
4. Confirm the action to switch the user session.
5. When you land on the logon screen, observe that the text remains displayed on the braille device.

Indicators of compromise

Last braille text still on device

Workarounds

Ensure that no sensitive information is displayed on the lock screen before signing out via the alt+ctrl+delete menu.

• Navigate to a different application first; or
• Lock the machine (Windows+l) first.

Timeline

• Reported: 2025/01/10
• Acknowledged by NV Access: 2025/01/14
• Fix released - NVDA 2025.1: 2025/06/16

For more information

If you have any questions or comments about this advisory:

• Email us at [email protected]