What is the CVSS score of CVE-2026-42970?

CVE-2026-42970 has a contested CVSS base score of 5.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-42970?

Yes, a patch is available for CVE-2026-42970. Update the affected software to the latest version immediately.

Windows Push Notifications CVE-2026-42970

EUVD-2026-35732 MEDIUM

Information Exposure (CWE-200)

2026-06-09 secure@microsoft.com

GHSA-jhp3-6rv9-cmh3

Information Disclosure Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

Medium

Disputed · 5.5 Vendor: microsoft

Temporal: 4.8

Severity by source

Sources disagree (Medium–Critical)

Vendor (microsoft) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

ENISA EUVD

CRITICAL

qualitative

CIRCL (temporal)

4.8 MEDIUM

cvss

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:55 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

MEDIUM 5.5

DescriptionCVE.org

Use of uninitialized resource in Windows Push Notifications allows an authorized attacker to disclose information locally.

AnalysisAI

Windows Push Notifications contains a use-of-uninitialized-resource flaw (CWE-200) that enables authenticated local attackers to disclose sensitive information across a wide breadth of Microsoft Windows desktop and server platforms. Spanning Windows 10 through Windows 11 25H2 and Windows Server 2012 through Server 2025, the vulnerability carries a CVSS 5.5 Medium score with high confidentiality impact (C:H) but no integrity or availability impact. Microsoft has released patches via the June 2026 Patch Tuesday cycle; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The Windows Push Notifications platform (WNS) is a built-in Windows OS subsystem responsible for delivering toast, tile, badge, and raw notifications from cloud services and local apps to the Windows shell and applications. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) paired with the 'use of uninitialized resource' description indicates that memory structures or buffers within the Push Notifications service are not zeroed or properly initialized before being consumed or returned, creating a condition where residual memory contents can be read by a calling process. The CVSS vector AV:L/AC:L/PR:L/UI:N is consistent with a local API or IPC abuse scenario where a low-privileged user-mode process interacts with the notification service and receives uninitialized stack or heap data. The affected CPE scope spans Windows NT kernel build lines from 6.2.x (Server 2012) through 10.0.28000.x (Windows 11 26H1), suggesting the flaw exists in a shared notification-handling code path present across multiple Windows generations.

RemediationAI

Apply Microsoft's security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42970. The patch brings affected systems to the following minimum build versions: Windows 11 25H2 to 10.0.26200.8655, Windows 11 26H1 to 10.0.28000.2269, Windows 11 24H2 to 10.0.26100.8655, Windows 11 23H2 to 10.0.22631.7219, Windows 10 22H2 to 10.0.19045.7417, Windows 10 21H2 to 10.0.19044.7417, Windows 10 1809 to 10.0.17763.8880, Windows 10 1607 to 10.0.14393.9234, Windows Server 2025 to 10.0.26100.32995, Windows Server 2022 to 10.0.20348.5256, Windows Server 2019 to 10.0.17763.8880, Windows Server 2016 to 10.0.14393.9234, Windows Server 2012 R2 to 6.3.9600.23228, and Windows Server 2012 to 6.2.9200.26132. For systems where patching is temporarily infeasible - particularly legacy Server 2012/2012 R2 systems past extended support - a compensating control is to restrict local interactive and network logon rights to the Push Notifications service host process (WpnService) via Group Policy, limiting which user accounts can interact with the service. This reduces the pool of potential local attackers but does not eliminate the vulnerability and may affect application notification delivery. Prioritize patching over workarounds given patch availability.