EUVD-2026-43846
GHSA-4gjp-9g3v-jfmp
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local-only attack requiring a low-privilege account; confidentiality impact only as key material is read but not modified or destroyed, with no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use of a cryptographic primitive with a risky implementation in Windows Key Guard allows an authorized attacker to bypass a security feature locally.
AnalysisAI
Windows Key Guard on multiple Windows 10, Windows 11, and Windows Server editions exposes a cryptographic security bypass to locally authenticated low-privilege users due to CWE-1240 (Use of a Cryptographic Primitive with a Risky Implementation), allowing protected key material to be accessed in violation of the Key Guard security boundary. Affected builds span Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025, representing a broad swath of Microsoft's current supported OS surface. No public exploit identified at time of analysis; EPSS sits at 0.21% (11th percentile) and SSVC classifies exploitation status as none with no automation potential, indicating low near-term exploitation probability despite the ubiquitous footprint.
Technical ContextAI
Windows Key Guard is a Microsoft security feature designed to isolate and protect cryptographic key material from unauthorized access, functioning as a boundary between user-mode processes and protected key stores. CWE-1240 (Use of a Cryptographic Primitive with a Risky Implementation) indicates the root cause is not an algorithmic flaw per se but a dangerous or deprecated usage of a cryptographic construct - for example, reliance on a weak key wrapping scheme, insecure key derivation function, or use of a primitive in a mode that undermines its security guarantees. The CPE strings confirm affected components span cpe:2.3:a:microsoft:windows_10_version_1809 through cpe:2.3:a:microsoft:windows_server_2025 across both desktop and server product lines. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N confirms the exploit path is local with low privilege entry, no user interaction, and a High confidentiality impact confined to the vulnerable system - consistent with key material exfiltration rather than arbitrary code execution.
RemediationAI
Apply the Microsoft-issued security update for CVE-2026-50303 via Windows Update or through the Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50303. Patched build thresholds confirmed via EUVD-2026-43846 are: Windows 10 1809 and Windows Server 2019 to build 10.0.17763.9020 or later; Windows 10 21H2 to 10.0.19044.7548 or later; Windows 10 22H2 to 10.0.19045.7548 or later; Windows Server 2022 to 10.0.20348.5386 or later; Windows 11 24H2 to 10.0.26100.8875 or later; Windows Server 2025 to 10.0.26100.33158 or later; Windows 11 25H2 to 10.0.26200.8875 or later; Windows 11 26H1 to 10.0.28000.2269 or later. Where patching is not immediately feasible, restrict interactive local logon rights on sensitive systems to the minimum necessary set of accounts using Group Policy (deny logon locally for non-essential users), and monitor key store access via Windows Security auditing events - note that these controls reduce exposure but do not eliminate the underlying cryptographic weakness and must not substitute for the vendor patch.
More in Windows 10 Version 1809
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker corrupt kernel memory via a use-
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today