Microsoft Windows CVE-2026-50347

Exploitation requires local processing of attacker-supplied content by the affected Windows Data DLL and mandatory user interaction (UI:R) - the victim must open or otherwise cause the malicious file/data to be parsed; it is not remotely triggerable over the network without that action. No pre-existing authentication or elevated privileges are needed on the attacker's part (PR:N), and attack complexity is low (AC:L), but the local vector (AV:L) means the attacker must first get their crafted content onto and opened on the target system. The key limiting factors are the reliance on user interaction and local content delivery, which prevent unattended, wormable, or purely remote exploitation; impact is bounded to the privileges of the user who opens the content.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes a local, low-complexity, unauthenticated attack that requires user interaction and yields full confidentiality, integrity, and availability impact - the classic profile of a malicious-file or malicious-content 'open-and-own' bug rather than a remotely wormable flaw. Although PR:N technically means no pre-existing privileges are needed, the AV:L plus UI:R combination means an attacker must deliver content and rely on the victim to act, which materially limits automatability and scale. No EPSS score, no POC, and no KEV listing were provided, so there is no evidence of active or imminent mass exploitation; this reads as a serious but not emergency patch - high impact if triggered, but gated by user interaction and local delivery. The ubiquity of Windows raises aggregate exposure even though per-target exploitation is not trivial.

An attacker crafts a malicious file or data blob that, when processed by the vulnerable Windows Data DLL, overflows a heap buffer; they deliver it via email attachment, download, or a shared document and rely on the victim to open it. When the user opens the content locally, the overflow corrupts the heap and executes attacker-controlled code in the context of the logged-on user. No public exploit is identified at time of analysis, but the low attack complexity (AC:L) makes reliable exploitation plausible for a capable actor once details are known.