Windows Key Guard CVE-2026-50303

Exploitation requires a valid local user account on the target Windows system with at minimum standard (low) privileges, consistent with PR:L in the CVSS vector - a fully unauthenticated remote attack path does not exist. The vulnerability is confined to the Windows Key Guard component; systems where Key Guard is not initialized or where no keys have been enrolled may not expose the vulnerable code path, though this limitation is not explicitly confirmed in available public data. The attack is restricted entirely to local access (AV:L): no network-facing exploitation path exists, and no user interaction is required once local session access is established (UI:N). Scope is unchanged (S:U), meaning impact is bounded to the targeted system and cannot directly pivot to adjacent systems via the vulnerability itself. Key limiting factors for defenders to weigh: the attacker must first obtain local interactive or RDP session access; SSVC confirms no automation potential, ruling out worm propagation; and EPSS at 0.21% indicates no observed exploitation pattern at time of analysis.

Real-world risk is moderate despite the CVSS 5.5 (Medium) rating, and the signal mosaic is internally consistent. AV:L limits exploitation to actors with existing local sessions, directly eliminating remote attack paths. PR:L requires at minimum a standard authenticated account, ruling out fully unauthenticated scenarios. SSVC classifies the vulnerability as not automatable, reinforcing that mass scanning or worm-style exploitation is not viable. EPSS at 0.21% (11th percentile) aligns with SSVC's 'exploitation: none' classification - no observed in-the-wild activity at time of analysis, and the CVE is absent from CISA KEV. SSVC technical impact of 'partial' is consistent with confidentiality-only impact (C:H, I:N, A:N), meaning key material can be read but not altered or destroyed. The primary real-world concern is insider threat or post-compromise scenarios: an attacker who has already established a foothold with a low-privilege account could use this bypass to extract Key Guard-protected secrets, potentially enabling credential theft, decryption of protected data, or privilege escalation as a second-stage action. The ubiquitous Windows deployment footprint elevates aggregate exposure even though per-instance exploitation probability is low.

A locally authenticated standard user on an unpatched Windows system executes a crafted process that invokes the Windows Key Guard cryptographic interface and exploits the risky primitive implementation to bypass the key protection boundary. With the security feature circumvented, the attacker reads cryptographic key material - such as credentials or encryption keys - that should be inaccessible to low-privilege processes, enabling potential decryption of protected data or facilitation of further lateral movement. No public exploit identified at time of analysis, but the low attack complexity (AC:L) means that once the weak primitive usage is reverse-engineered, exploitation is straightforward for an actor with local access.