EUVD-2026-43843
GHSA-w4pc-879w-rjww
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local attack with low-privilege requirement, no user interaction; only confidentiality impacted with no integrity or availability effect, fully consistent with the vendor-supplied vector.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Exposure of sensitive information to an unauthorized actor in Windows Trusted Runtime Interface Driver allows an authorized attacker to disclose information locally.
AnalysisAI
Sensitive information disclosure in the Windows Trusted Runtime Interface Driver permits a locally authenticated, low-privileged attacker to read protected data from the affected system. The flaw impacts Windows 10 (21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2025 across both full and Server Core installations. No public exploit code has been identified at time of analysis, and CISA has not listed this in the Known Exploited Vulnerabilities catalog; Microsoft has released patches resolving the issue.
Technical ContextAI
The Windows Trusted Runtime Interface Driver is a kernel-mode component responsible for mediating trusted execution and runtime interfaces within Windows. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) indicates the driver fails to properly restrict access to sensitive data - likely kernel memory, credentials, cryptographic material, or privileged configuration - when accessed by a process running under a low-privileged local account. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms local-only access with no user interaction required and no scope change, meaning exploitation is contained to the vulnerable system. Affected CPE strings (cpe:2.3:a:microsoft:windows_10_version_21h2 through windows_server_2025) confirm this is a first-party Microsoft driver present across modern Windows client and server SKUs.
RemediationAI
Apply the Microsoft security update that raises each affected version to or above its respective fixed build: Windows 10 21H2 to build 10.0.19044.7548 or later, Windows 10 22H2 to 10.0.19045.7548 or later, Windows 11 24H2 to 10.0.26100.8875 or later, Windows 11 25H2 to 10.0.26200.8875 or later, Windows 11 26H1 to 10.0.28000.2269 or later, and Windows Server 2025 (including Server Core) to 10.0.26100.33158 or later. The authoritative update guidance is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50350. If immediate patching is not feasible, a compensating control is to enforce strict local logon restrictions - removing interactive logon rights for non-administrative accounts via Group Policy (User Rights Assignment: Deny log on locally) reduces the pool of potential threat actors, though this may impact users requiring local sessions. Restricting access to affected systems via network segmentation does not mitigate this flaw given its local-only attack vector.
More in Windows Server 2025
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today