Windows Notification CVE-2026-50334

Exploitation requires an authenticated local session with at minimum low-privilege user rights on the affected Windows system (PR:L, AV:L per CVSS vector). The attacker must be an 'authorized attacker' per the description - meaning a legitimate, logged-in account rather than an external threat actor. No network access is required; no special configuration or non-default feature activation is described. Exploitation is not automatable per SSVC. What limits exploitation: the attacker must already have local access to the machine, ruling out remote and unauthenticated scenarios; impact is limited to confidentiality (no code execution or data tampering); and the notification subsystem's typical content (toast alerts, app notifications) may or may not carry sensitive data depending on what applications are running. Systems where users share hardware - terminal servers, shared workstations, VDI environments - face higher realistic risk than single-user endpoints.

All available signals converge on a lower real-world priority. CVSS 5.5 (Medium) with AV:L/PR:L reflects the local, authenticated prerequisite that significantly limits exploitability - remote, unauthenticated mass exploitation is not possible. EPSS of 0.36% (28th percentile) indicates that exploitation is statistically rare among observed vulnerabilities at this tier. SSVC assessment reinforces this: Exploitation status is 'none', the attack is not automatable, and technical impact is only 'partial'. The vulnerability is not listed in CISA KEV. No public proof-of-concept code is identified. The primary real-world risk scenario is insider threat or post-compromise privilege escalation, where a local attacker on a shared system reads notification content they should not see. This is a genuine information disclosure but does not enable remote takeover, code execution, or data modification. Defenders should prioritize this as a routine patch-cycle item rather than an emergency response.

An authenticated local user on a shared Windows workstation or terminal server session leverages the notification subsystem to read sensitive notification content - such as security alert messages, authentication codes, or confidential application notifications - generated by another user's session or a higher-privileged process. No public exploit code is known, so exploitation would currently require manual or custom tooling. The local-only attack vector means an attacker must already have an interactive or RDP session on the target machine.