Microsoft Windows CVE-2026-50337

Exploitation requires the attacker to already have local, authenticated access with low-level privileges (CVSS PR:L, AV:L) - this is a second-stage elevation primitive, not a remote entry point. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once local code execution is achieved the path to SYSTEM is reliable. The exploit interacts with the Windows Notification component, which is present by default on all listed SKUs, so no special non-default configuration is called out in the description. The primary limiting factors are the need for a pre-existing foothold and the ability to run arbitrary local code; systems where untrusted users can log in interactively (shared workstations, RDS/terminal servers, Citrix hosts) face the highest realistic risk.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High) describes a classic local elevation-of-privilege primitive: an attacker needs an existing foothold with at least low-level user privileges, but no user interaction and low attack complexity, and on success gains full CIA impact within the same security scope (S:U). No EPSS score, KEV listing, or SSVC decision data is present in the input, so probabilistic exploitation signals are unknown rather than low and should not be treated as reassuring. No public exploit is identified at time of analysis. One data conflict must be flagged: the Description and CVSS both describe privilege elevation (I:H integrity impact), yet the Tags field lists 'Information Disclosure' - this labeling is inconsistent with an EoP class and should be verified against the Microsoft advisory. Because the affected component is ubiquitous and EoP bugs are prime second-stage tools for ransomware and post-compromise operators, this warrants prioritized Patch Tuesday rollout even though it is not remotely exploitable and not confirmed exploited.

An attacker who has already gained low-privileged access to a Windows host - for example via phishing, a compromised service account, or a standard user session on a shared terminal server - runs a crafted local program that feeds a malformed object into the Windows Notification component, triggering the incorrect type conversion. The resulting type confusion is leveraged to execute code at SYSTEM, giving full control of the machine. No user interaction is required and attack complexity is low, though local code execution is a prerequisite; no public exploit is identified at time of analysis.