EUVD-2026-35732
GHSA-jhp3-6rv9-cmh3
Severity by source
Sources disagree (Medium–Critical)AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: microsoft
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
Use of uninitialized resource in Windows Push Notifications allows an authorized attacker to disclose information locally.
AnalysisAI
Windows Push Notifications contains a use-of-uninitialized-resource flaw (CWE-200) that enables authenticated local attackers to disclose sensitive information across a wide breadth of Microsoft Windows desktop and server platforms. Spanning Windows 10 through Windows 11 25H2 and Windows Server 2012 through Server 2025, the vulnerability carries a CVSS 5.5 Medium score with high confidentiality impact (C:H) but no integrity or availability impact. Microsoft has released patches via the June 2026 Patch Tuesday cycle; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
The Windows Push Notifications platform (WNS) is a built-in Windows OS subsystem responsible for delivering toast, tile, badge, and raw notifications from cloud services and local apps to the Windows shell and applications. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) paired with the 'use of uninitialized resource' description indicates that memory structures or buffers within the Push Notifications service are not zeroed or properly initialized before being consumed or returned, creating a condition where residual memory contents can be read by a calling process. The CVSS vector AV:L/AC:L/PR:L/UI:N is consistent with a local API or IPC abuse scenario where a low-privileged user-mode process interacts with the notification service and receives uninitialized stack or heap data. The affected CPE scope spans Windows NT kernel build lines from 6.2.x (Server 2012) through 10.0.28000.x (Windows 11 26H1), suggesting the flaw exists in a shared notification-handling code path present across multiple Windows generations.
RemediationAI
Apply Microsoft's security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42970. The patch brings affected systems to the following minimum build versions: Windows 11 25H2 to 10.0.26200.8655, Windows 11 26H1 to 10.0.28000.2269, Windows 11 24H2 to 10.0.26100.8655, Windows 11 23H2 to 10.0.22631.7219, Windows 10 22H2 to 10.0.19045.7417, Windows 10 21H2 to 10.0.19044.7417, Windows 10 1809 to 10.0.17763.8880, Windows 10 1607 to 10.0.14393.9234, Windows Server 2025 to 10.0.26100.32995, Windows Server 2022 to 10.0.20348.5256, Windows Server 2019 to 10.0.17763.8880, Windows Server 2016 to 10.0.14393.9234, Windows Server 2012 R2 to 6.3.9600.23228, and Windows Server 2012 to 6.2.9200.26132. For systems where patching is temporarily infeasible - particularly legacy Server 2012/2012 R2 systems past extended support - a compensating control is to restrict local interactive and network logon rights to the Push Notifications service host process (WpnService) via Group Policy, limiting which user accounts can interact with the service. This reduces the pool of potential local attackers but does not eliminate the vulnerability and may affect application notification delivery. Prioritize patching over workarounds given patch availability.
More in Windows 10 1607
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Windows Shell contains a protection mechanism failure (CVE-2026-21510, CVSS 8.8) that allows unauthenticated remote atta
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptograph
Desktop Window Manager (DWM) in Windows contains a type confusion vulnerability (CVE-2026-21519, CVSS 7.8) that enables
Windows Common Log File System Driver contains another use-after-free for local privilege escalation, the latest in a se
Windows Storage contains an elevation of privilege vulnerability through symlink following that allows authorized attack
Windows Ancillary Function Driver for WinSock contains a use-after-free enabling local privilege escalation through a nu
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today