EUVD-2026-43822
GHSA-hqcj-32q2-cj55
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local attack requiring an authenticated low-privilege user; uninitialized buffer read yields high confidentiality impact with zero integrity or availability consequence.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally.
AnalysisAI
Uninitialized memory disclosure in the Windows SMB implementation enables a locally authenticated, low-privileged attacker to read sensitive contents from uninitialized kernel or heap buffers, achieving high confidentiality impact within the affected system. The vulnerability spans Windows 10 (from version 1607 through 22H2), Windows 11 (versions 24H2 through 26H1), and Windows Server 2012 through 2025 across both full and Server Core installation types. No public exploit code has been identified and CISA SSVC assesses exploitation status as none, placing this firmly in the patch-and-monitor category rather than emergency response.
Technical ContextAI
CWE-908 (Use of Uninitialized Resource) describes a code path where a buffer or variable is consumed before it has been assigned a deterministic value, allowing whatever bytes occupied that memory region previously to be returned or processed. In the Windows SMB (Server Message Block) protocol stack - a core file-sharing and inter-process-communication mechanism present in every supported Windows release - this manifests as an uninitialized buffer that may be surfaced to an authenticated caller. SMB is deeply integrated into both client and server Windows editions; CPE data confirms the affected products span the microsoft:windows_10 and microsoft:windows_server families from version 1607/Server 2012 forward. The CVSS vector AV:L confirms the vulnerability is exercised through local system interaction rather than over the network, indicating the flaw exists in an SMB code path triggered locally (e.g., via named pipes, loopback, or local IPC) rather than remotely accessible SMB shares.
RemediationAI
The primary remediation is to apply the Microsoft-released patch via Windows Update or WSUS, targeting the fixed build versions enumerated in the EUVD data: Windows 10 1607 and Server 2016 require build 10.0.14393.9339 or later; Windows 10 1809 and Server 2019 require 10.0.17763.9020 or later; Windows 10 21H2 requires 10.0.19044.7548 or later; Windows 10 22H2 requires 10.0.19045.7548 or later; Windows 11 24H2 requires 10.0.26100.8875 or later; Windows 11 25H2 requires 10.0.26200.8875 or later; Windows 11 26H1 requires 10.0.28000.2269 or later; Server 2012/Server Core requires 6.2.9200.26226 or later; Server 2012 R2/Server Core requires 6.3.9600.23291 or later; Server 2022 requires 10.0.20348.5386 or later; and Server 2025/Server Core requires 10.0.26100.33158 or later. The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49801 is the authoritative source for update packages. As a compensating control for systems where patching is temporarily infeasible, restricting local interactive logon rights to only trusted administrative accounts (via Group Policy > User Rights Assignment) reduces the pool of potential attackers, though this may affect legitimate user workflows. Disabling SMB entirely (Set-SmbServerConfiguration -EnableSMB1Protocol $false and disabling SMB2 where operationally tolerable) would eliminate the attack surface but has significant operational impact on file sharing and domain authentication.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-908 – Use of Uninitialized Resource
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today