Windows RPC Runtime CVE-2026-50346

The attacker must already possess valid low-privileged local access to the target Windows system (CVSS PR:L), and exploitation occurs entirely locally (AV:L) with no user interaction (UI:N) and low attack complexity (AC:L). The specific prerequisite is the ability to reach and invoke the affected RPC Runtime interface as an authorized-but-underprivileged principal; the flaw is an authorization check failure rather than a network-exposed condition. Limiting factors: it cannot be triggered remotely without first obtaining a local account or code-execution foothold, and it is bounded to the enumerated Windows 10/11 and Server 2012-2025 builds - hosts already patched or running unaffected builds are not exploitable.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H describes a local (AV:L), low-complexity (AC:L) attack requiring existing low privileges (PR:L) and no user interaction, yielding full high impact on confidentiality, integrity, and availability within an unchanged scope - a classic reliable local privilege-escalation profile scoring 7.8 (High). This is not a remotely wormable issue, which lowers mass-exploitation risk, but local EoP flaws in ubiquitous Windows components are highly valued as post-compromise chaining steps and are historically incorporated into attacker toolkits. No EPSS score, SSVC decision, or POC indicator was supplied in the input, and the CVE is not in CISA KEV, so there is no confirmed active exploitation; the primary risk driver is the enormous install base combined with a low bar to exploit once initial access is achieved. The 'Authentication Bypass' tag conflicts somewhat with the improper-authorization framing - verify the exact primitive with Microsoft's advisory.

An attacker who has already gained a low-privileged foothold on a Windows host - for example via phishing, a compromised standard user account, or a low-privilege service - invokes the vulnerable RPC Runtime operation to bypass authorization checks and execute code or actions in a SYSTEM context. Given AV:L/AC:L, the technique is reliable and requires no victim interaction, making it an ideal second-stage step to escalate from initial access to full host compromise. No public exploit identified at time of analysis.