What is the CVSS score of CVE-2026-50297?

CVE-2026-50297 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Windows Win32K are affected by CVE-2026-50297?

A privilege escalation vulnerability in Windows Win32K (CVE-2026-50297) allows any low-privileged user to gain full system control on Windows 10, 11, and Server systems (2012-2025), affecting all…. A patch is available.

How to fix or mitigate CVE-2026-50297?

Within 24 hours: Create inventory of all Windows 10, 11, and Server (2012-2025) systems in production and lab environments to establish patch scope. Within 7 days: Retrieve the latest Microsoft Cumulative Update or Security Update containing the CVE-2026-50297 fix, deploy to test environments, and validate compatibility with business-critical applications and security policies. Within 30 days: Roll out patches to production systems in priority order (Windows Servers first, then sensitive workstations, then general-purpose desktops) following your change management process to minimize operational impact.

Windows Win32K CVE-2026-50297

EUVD-2026-43838 HIGH

Improper Access Control (CWE-284)

2026-07-14 microsoft

GHSA-vrqp-wgcr-w7fh

Authentication Bypass Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation Windows Server 2012 Server Core Installation Windows Server 2012 R2 Windows Server 2012 R2 Server Core Installation

7.0

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local privilege escalation from an authenticated standard user (AV:L, PR:L); AC:H reflects a likely race/state condition; full SYSTEM compromise gives C:H/I:H/A:H with unchanged scope.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 18:24 vuln.today

CVE Published

Jul 14, 2026 - 17:06 cve.org

HIGH 7.0

DescriptionCVE.org

Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in the Windows Win32K kernel-mode subsystem allows an already-authenticated, low-privileged user to elevate to SYSTEM through improper access control (CWE-284). Affected builds span Windows 10 (1607 through 22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2012 through 2025. No public exploit identified at time of analysis, and it is not listed in CISA KEV; Microsoft has released a patch.

Technical ContextAI

Win32K (win32k.sys and related kernel components) is the Windows kernel-mode driver that implements the GUI window manager and Graphics Device Interface, running in ring 0 and historically one of the largest local privilege-escalation attack surfaces in Windows. The root cause is classified as CWE-284 (Improper Access Control), meaning the subsystem fails to correctly enforce a security check on an object or operation that a low-privileged process should not be permitted to perform, allowing that process to reach privileged kernel functionality. Per the supplied CPE data the flaw lives in the OS kernel graphics stack shipped uniformly across desktop and server SKUs (cpe:2.3:a:microsoft:windows_10_version_1607 through windows_server_2025), which is why the affected list is so broad - the vulnerable code is a shared core component rather than an optional feature.

RemediationAI

Patch available per vendor advisory - apply the Microsoft security update for CVE-2026-50297 for your specific Windows build via the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50297, which links the corresponding monthly cumulative/KB update for each affected SKU (Windows 10 1607-22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2012-2025 including Server Core). No exact fixed version string is provided in the input, so pull the precise KB number from the advisory rather than assuming one. Because exploitation requires local low-privileged code execution, effective compensating controls until patching include enforcing least privilege and removing unnecessary interactive/local logon rights, restricting the ability of untrusted users to run arbitrary code on servers (particularly RDS/multi-user hosts where a standard user could target other tenants), and enabling EDR detections for Win32K exploitation primitives; note these controls reduce but do not eliminate exposure since any local standard-user foothold remains a viable launch point.