EUVD-2026-43933
GHSA-8ww8-mqm9-w2vr
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local-only access, low-privilege account required, pure confidentiality impact with no integrity or availability effects, no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Exposure of sensitive information to an unauthorized actor in Windows Notification allows an authorized attacker to disclose information locally.
AnalysisAI
Local information disclosure in Windows Notification affects authenticated users across a wide range of Microsoft Windows 10, Windows 11, and Windows Server releases. An attacker with low-privilege local access can exploit this CWE-200 flaw to read sensitive data that should be inaccessible to their account, with no user interaction required. No public exploit or active exploitation has been identified at time of analysis, and Microsoft has released patched builds addressing all affected versions.
Technical ContextAI
The Windows Notification subsystem, which manages toast notifications, action center events, and notification delivery across user sessions, contains an exposure of sensitive information flaw (CWE-200). CWE-200 indicates that the component improperly controls access to sensitive data - likely by allowing a low-privileged process or user to read notification content or metadata that belongs to another session or process context. CPE data confirms affected products span Windows 10 versions 1607 through 22H2, Windows 11 versions 24H2, 25H2, and 26H1, and Windows Server editions from 2012 through 2025 including Server Core installation modes. The local-only attack vector (AV:L) and requirement for an authorized but low-privileged attacker (PR:L) are consistent with a design or access control flaw in how the Notification service exposes data to user-mode callers.
RemediationAI
Apply the vendor-released patches through Windows Update or WSUS targeting the fixed build versions identified in the EUVD dataset: Windows 10 1607 and Server 2016 should be updated to build 10.0.14393.9339 or later; Windows 10 1809 and Server 2019 to 10.0.17763.9020 or later; Windows 10 21H2 to 10.0.19044.7548 or later; Windows 10 22H2 to 10.0.19045.7548 or later; Windows 11 24H2 and Server 2025 to 10.0.26100.8875 or later; Windows 11 25H2 to 10.0.26200.8875 or later; Windows 11 26H1 to 10.0.28000.2269 or later; Server 2022 to 10.0.20348.5386 or later; Server 2012 to 6.2.9200.26226 or later; and Server 2012 R2 to 6.3.9600.23291 or later. The Microsoft MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50334 provides the authoritative patch reference. As a compensating control where patching is delayed, administrators can restrict local logon access to sensitive systems to the minimum necessary set of accounts, which reduces the pool of principals capable of triggering the disclosure. No specific workaround is published by Microsoft; patching remains the only confirmed remediation.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today