What is the CVSS score of CVE-2026-50296?

CVE-2026-50296 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Windows Server 2016 are affected by CVE-2026-50296?

Microsoft Windows Graphics Kernel contains a vulnerability that could enable any internal user with system access to assume administrative privileges, creating a critical risk for unauthorized…. A patch is available.

How to fix or mitigate CVE-2026-50296?

Within 24 hours, conduct a complete inventory of Windows 10, Windows 11, and Windows Server systems in your environment to establish full scope. Within 7 days, deploy the Microsoft vendor-released patch for Windows Graphics Kernel CVE-2026-50296 across all affected systems using your organization's standard change management process, prioritizing production servers and systems handling sensitive data. Within 30 days, validate patch deployment completion across all identified systems and establish monitoring for exploitation attempts.

Windows Server 2016 CVE-2026-50296

EUVD-2026-43837 HIGH

Use After Free (CWE-416)

2026-07-14 microsoft

GHSA-g36c-2r9q-h38x

Denial Of Service Use After Free Memory Corruption Microsoft Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation

7.0

CVSS 3.1 · Vendor: microsoft

Temporal: 6.1

Severity by source

Vendor (microsoft) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.1 MEDIUM

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 18:26 vuln.today

CVE Published

Jul 14, 2026 - 17:06 cve.org

HIGH 7.0

DescriptionCVE.org

Use after free in Graphics Kernel allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in the Microsoft Windows Graphics Kernel component allows a low-privileged local user to elevate to SYSTEM by exploiting a use-after-free (CWE-416) memory corruption condition. The flaw affects a broad range of Windows 10, Windows 11, and Windows Server releases, was reported by Microsoft, and has a vendor-released patch available. No public exploit is identified at time of analysis and it is not listed in CISA KEV; the high attack complexity (AC:H) makes reliable exploitation non-trivial.