EUVD-2026-35733
GHSA-q7qh-mggg-7m5j
Severity by source
Sources disagree (Medium–Critical)AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: microsoft
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
Use of uninitialized resource in Windows Push Notifications allows an authorized attacker to disclose information locally.
AnalysisAI
Windows Push Notifications contains a use-of-uninitialized-resource flaw (CWE-200) that enables a locally authenticated attacker to read sensitive information from memory without elevation of privilege. Affecting a wide range of Windows 10, Windows 11, and Windows Server builds, the vulnerability requires only low-privilege local access and no user interaction to trigger. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none with partial technical impact, placing this in a lower-urgency remediation band despite the High confidentiality rating in the CVSS vector.
Technical ContextAI
The affected component is the Windows Push Notifications subsystem - the platform infrastructure responsible for delivering WNS (Windows Notification Service) messages to applications. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) combined with the description's 'use of uninitialized resource' points to a scenario where the notification handler allocates or reuses a buffer without zeroing it, leaving residual memory contents accessible to a calling process. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U confirms the exploit is local, low-complexity, and requires only a standard user token - consistent with a local API or IPC call that leaks kernel or cross-process memory. Affected CPE targets span Windows NT 10.0 builds across consumer (Windows 10/11) and server (Server 2016, 2019, 2022, 2025) lines.
RemediationAI
Apply the Microsoft security update addressing CVE-2026-42973, which raises each affected build to its respective patched baseline: Windows 10 1607 and Server 2016 to 10.0.14393.9234 or later; Windows 10 1809 and Server 2019 to 10.0.17763.8880 or later; Windows 10 21H2 to 10.0.19044.7417 or later; Windows 10 22H2 to 10.0.19045.7417 or later; Windows 11 23H2 to 10.0.22631.7219 or later; Windows 11 24H2 and 25H2 to 10.0.26100.8655 / 10.0.26200.8655 or later; Server 2022 to 10.0.20348.5256 or later; Server 2025 to 10.0.26100.32995 or later; and Windows 11 26H1 to 10.0.28000.2269 or later. The advisory is published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42973. No workaround or feature-disable path has been documented by Microsoft; given that Push Notifications is a core platform service, disabling it would break UWP and Win32 app notification delivery and is not recommended as a compensating control. Prioritize patching endpoints where low-privilege users share systems with sensitive processes, such as multi-user terminal servers.
More in Windows 10 1607
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Windows Shell contains a protection mechanism failure (CVE-2026-21510, CVSS 8.8) that allows unauthenticated remote atta
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptograph
Desktop Window Manager (DWM) in Windows contains a type confusion vulnerability (CVE-2026-21519, CVSS 7.8) that enables
Windows Common Log File System Driver contains another use-after-free for local privilege escalation, the latest in a se
Windows Storage contains an elevation of privilege vulnerability through symlink following that allows authorized attack
Windows Ancillary Function Driver for WinSock contains a use-after-free enabling local privilege escalation through a nu
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today