EUVD-2026-43843
GHSA-w4pc-879w-rjww
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local attack with low-privilege requirement, no user interaction; only confidentiality impacted with no integrity or availability effect, fully consistent with the vendor-supplied vector.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Exposure of sensitive information to an unauthorized actor in Windows Trusted Runtime Interface Driver allows an authorized attacker to disclose information locally.
AnalysisAI
Sensitive information disclosure in the Windows Trusted Runtime Interface Driver permits a locally authenticated, low-privileged attacker to read protected data from the affected system. The flaw impacts Windows 10 (21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2025 across both full and Server Core installations. No public exploit code has been identified at time of analysis, and CISA has not listed this in the Known Exploited Vulnerabilities catalog; Microsoft has released patches resolving the issue.
Technical ContextAI
The Windows Trusted Runtime Interface Driver is a kernel-mode component responsible for mediating trusted execution and runtime interfaces within Windows. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) indicates the driver fails to properly restrict access to sensitive data - likely kernel memory, credentials, cryptographic material, or privileged configuration - when accessed by a process running under a low-privileged local account. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms local-only access with no user interaction required and no scope change, meaning exploitation is contained to the vulnerable system. Affected CPE strings (cpe:2.3:a:microsoft:windows_10_version_21h2 through windows_server_2025) confirm this is a first-party Microsoft driver present across modern Windows client and server SKUs.
RemediationAI
Apply the Microsoft security update that raises each affected version to or above its respective fixed build: Windows 10 21H2 to build 10.0.19044.7548 or later, Windows 10 22H2 to 10.0.19045.7548 or later, Windows 11 24H2 to 10.0.26100.8875 or later, Windows 11 25H2 to 10.0.26200.8875 or later, Windows 11 26H1 to 10.0.28000.2269 or later, and Windows Server 2025 (including Server Core) to 10.0.26100.33158 or later. The authoritative update guidance is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50350. If immediate patching is not feasible, a compensating control is to enforce strict local logon restrictions - removing interactive logon rights for non-administrative accounts via Group Policy (User Rights Assignment: Deny log on locally) reduces the pool of potential threat actors, though this may impact users requiring local sessions. Restricting access to affected systems via network segmentation does not mitigate this flaw given its local-only attack vector.
More in Windows 10 Version 21H2
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker corrupt kernel memory via a use-
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Local privilege escalation in the Microsoft Windows Kernel allows an already-authenticated attacker to elevate to SYSTEM
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today