What is the CVSS score of CVE-2026-42971?

CVE-2026-42971 has a contested CVSS base score of 5.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-42971?

Yes, a patch is available for CVE-2026-42971. Update the affected software to the latest version immediately.

Windows Push Notifications CVE-2026-42971

EUVD-2026-35731 MEDIUM

Information Exposure (CWE-200)

2026-06-09 secure@microsoft.com

GHSA-j627-g2r3-f2jq

Information Disclosure Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

Medium

Disputed · 5.5 Vendor: microsoft

Temporal: 4.8

Severity by source

Sources disagree (Medium–Critical)

Vendor (microsoft) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

ENISA EUVD

CRITICAL

qualitative

CIRCL (temporal)

4.8 MEDIUM

cvss

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:56 vuln.today

Patch available

Jun 09, 2026 - 19:03 EUVD

CVE Published

Jun 09, 2026 - 17:17 nvd

MEDIUM 5.5

DescriptionCVE.org

Use of uninitialized resource in Windows Push Notifications allows an authorized attacker to disclose information locally.

AnalysisAI

Windows Push Notifications on multiple Windows 10, Windows 11, and Windows Server versions exposes sensitive memory contents through an uninitialized resource condition, allowing a low-privileged local user to read high-confidentiality data without any user interaction. The CVSS vector (AV:L/PR:L) confirms this is strictly a local privilege issue - no remote attack path exists - limiting its practical blast radius to insider threats and post-compromise lateral reconnaissance. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected versions.

Technical ContextAI

Windows Push Notifications (WPN) is the OS-level notification delivery platform, handling push payloads for both system and third-party applications across Windows 10, 11, and Server editions. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) arising from use of an uninitialized resource - a code path within the WPN subsystem reads from a memory region or handle that has not been properly initialized before use. This class of bug commonly exposes stale heap, stack, or kernel object memory from adjacent allocations, which may contain sensitive artifacts such as session tokens, decrypted data, or address-space layout information. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N confirms the attack surface is local, requires no elevated privileges, operates at low complexity, and yields high-confidentiality impact with no integrity or availability consequence. Affected build ranges span Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025, per EUVD-2026-35731.

RemediationAI

The primary remediation is to apply the Microsoft-released patches for each affected Windows version as confirmed by EUVD-2026-35731 and the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42971. Specific target build versions are: Windows 10 1607 and Server 2016 to 10.0.14393.9234; Windows 10 1809, Server 2019 to 10.0.17763.8880; Windows 10 21H2 to 10.0.19044.7417; Windows 10 22H2 to 10.0.19045.7417; Windows 11 23H2 to 10.0.22631.7219; Windows 11 24H2 to 10.0.26100.8655; Windows 11 25H2 to 10.0.26200.8655; Windows 11 26H1 to 10.0.28000.2269; Server 2022 to 10.0.20348.5256; Server 2025 to 10.0.26100.32995 (verify against MSRC due to build number discrepancy noted below). As a compensating control where immediate patching is not feasible, restrict interactive and remote desktop logon rights to only trusted accounts on exposed Server systems via Group Policy (User Rights Assignment: 'Allow log on locally' and 'Allow log on through Remote Desktop Services'), which reduces the pool of principals able to exploit this locally. This control does not eliminate the vulnerability but raises the privilege bar for exploitation on multi-user server systems. No side effects are associated with the patch itself.