EUVD-2026-43820
GHSA-2c9x-q6g3-36c7
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Local vector because kernel API access requires local execution; PR:N because standard unprivileged users can reach the vulnerable path; C:H for sensitive kernel data exposure; no integrity or availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an unauthorized attacker to disclose information locally.
AnalysisAI
Windows Kernel information disclosure across a broad range of Microsoft Windows desktop and server editions allows a local, unprivileged attacker to read sensitive kernel memory or system state not intended for user-space access. The CVSS:3.1 vector AV:L/AC:L/PR:N/UI:N confirms local code execution with no special privileges is sufficient to trigger the flaw. EPSS sits at 0.38% (30th percentile) with no CISA KEV listing and SSVC exploitation status of 'none,' indicating no confirmed or publicly observed active exploitation at time of analysis; however, kernel information leaks of this class are routinely used to stage ASLR-bypass steps in multi-stage privilege escalation chains.
Technical ContextAI
The root cause is CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), meaning the Windows Kernel inadvertently surfaces protected kernel-internal data - such as kernel pointer values, base addresses, or security-relevant internal structures - into a context accessible by unprivileged user-mode code, likely through a kernel API, syscall, or shared memory path. CPE strings confirm the flaw resides in the core Windows platform (microsoft:windows_10_version_*, microsoft:windows_11_version_*, microsoft:windows_server_*) spanning consumer and enterprise versions alike. Kernel info-leaks of this class historically enable Address Space Layout Randomization (ASLR) bypass by revealing the kernel base address or heap object pointers, making the practical danger of the flaw extend well beyond its standalone confidentiality-only CVSS profile when combined with a co-located privilege escalation bug.
RemediationAI
Apply the Microsoft-released patches via Windows Update or directly through the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50294. Confirmed fixed build targets per EUVD data: Windows 10 1607 and Server 2016 to 10.0.14393.9339 or later; Windows 10 1809 and Server 2019 to 10.0.17763.9020 or later; Windows 10 21H2 to 10.0.19044.7548 or later; Windows 10 22H2 to 10.0.19045.7548 or later; Windows 11 24H2 and Server 2025 to 10.0.26100.8875 or later; Windows 11 25H2 to 10.0.26200.8875 or later; Windows 11 26H1 to 10.0.28000.2269 or later; Server 2012 to 6.2.9200.26226 or later; Server 2012 R2 to 6.3.9600.23291 or later; Server 2022 to 10.0.20348.5386 or later. Because the attack vector is strictly local (AV:L), network-perimeter controls will not mitigate this flaw - the patch is the only reliable fix. Organizations still running Windows Server 2012 or 2012 R2 should note these products reached end of mainstream support; extended patches under ESU programs may apply, but migration to a supported platform remains the authoritative long-term remediation.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today