What is the CVSS score of CVE-2026-42973?

CVE-2026-42973 has a contested CVSS base score of 5.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-42973?

Yes, a patch is available for CVE-2026-42973. Update the affected software to the latest version immediately.

Windows Push Notifications CVE-2026-42973

EUVD-2026-35733 MEDIUM

Information Exposure (CWE-200)

2026-06-09 secure@microsoft.com

GHSA-q7qh-mggg-7m5j

Information Disclosure Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

Medium

Disputed · 5.5 Vendor: microsoft

Temporal: 4.8

Severity by source

Sources disagree (Medium–Critical)

Vendor (microsoft) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

ENISA EUVD

CRITICAL

qualitative

CIRCL (temporal)

4.8 MEDIUM

cvss

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:57 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

MEDIUM 5.5

DescriptionCVE.org

Use of uninitialized resource in Windows Push Notifications allows an authorized attacker to disclose information locally.

AnalysisAI

Windows Push Notifications contains a use-of-uninitialized-resource flaw (CWE-200) that enables a locally authenticated attacker to read sensitive information from memory without elevation of privilege. Affecting a wide range of Windows 10, Windows 11, and Windows Server builds, the vulnerability requires only low-privilege local access and no user interaction to trigger. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none with partial technical impact, placing this in a lower-urgency remediation band despite the High confidentiality rating in the CVSS vector.

Technical ContextAI

The affected component is the Windows Push Notifications subsystem - the platform infrastructure responsible for delivering WNS (Windows Notification Service) messages to applications. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) combined with the description's 'use of uninitialized resource' points to a scenario where the notification handler allocates or reuses a buffer without zeroing it, leaving residual memory contents accessible to a calling process. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U confirms the exploit is local, low-complexity, and requires only a standard user token - consistent with a local API or IPC call that leaks kernel or cross-process memory. Affected CPE targets span Windows NT 10.0 builds across consumer (Windows 10/11) and server (Server 2016, 2019, 2022, 2025) lines.

RemediationAI

Apply the Microsoft security update addressing CVE-2026-42973, which raises each affected build to its respective patched baseline: Windows 10 1607 and Server 2016 to 10.0.14393.9234 or later; Windows 10 1809 and Server 2019 to 10.0.17763.8880 or later; Windows 10 21H2 to 10.0.19044.7417 or later; Windows 10 22H2 to 10.0.19045.7417 or later; Windows 11 23H2 to 10.0.22631.7219 or later; Windows 11 24H2 and 25H2 to 10.0.26100.8655 / 10.0.26200.8655 or later; Server 2022 to 10.0.20348.5256 or later; Server 2025 to 10.0.26100.32995 or later; and Windows 11 26H1 to 10.0.28000.2269 or later. The advisory is published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42973. No workaround or feature-disable path has been documented by Microsoft; given that Push Notifications is a core platform service, disabling it would break UWP and Win32 app notification delivery and is not recommended as a compensating control. Prioritize patching endpoints where low-privilege users share systems with sensitive processes, such as multi-user terminal servers.