Windows Cryptographic Services CVE-2026-50352

Exploitation requires a valid, authenticated local user account with at minimum low-privilege access (CVSS PR:L, AV:L) - the attacker must be able to execute code on the local system, whether through an interactive logon, Remote Desktop Protocol session, or as a post-exploitation step after initial compromise. No network-facing attack surface exists; unauthenticated or purely remote attackers cannot trigger this vulnerability without first obtaining local execution. The vendor description does not specify a non-default configuration or particular feature-enablement prerequisite, suggesting the flaw affects standard Windows Cryptographic Services usage on any affected build. Exploitation is constrained exclusively to confidentiality loss - no integrity modification or availability disruption is possible, limiting the standalone utility of this vulnerability. The primary limiting factor for defenders is the local access requirement: environments that strictly control interactive logon rights reduce exposure to near zero.

All available risk signals align consistently at moderate-but-not-urgent priority. CVSS 5.5 (Medium) reflects the local attack vector and low-privilege requirement that bound real-world exploitability, offset by the high confidentiality impact (C:H) that makes any successful exploitation meaningful if cryptographic keys are exposed. EPSS at 0.47% (38th percentile) indicates that fewer than half of CVEs are considered less likely to be exploited than this one, but the absolute probability remains low. SSVC reinforces this: Exploitation is rated 'none,' the attack is not automatable (requires local interactive access), and Technical Impact is 'partial.' No CISA KEV listing and no public POC have been identified. The primary elevated-risk scenario is multi-tenant or shared infrastructure - Windows Server 2012 through 2025 environments where multiple users share local logon access - where a malicious insider or compromised low-privilege account could harvest cryptographic material from other tenants or services. For single-user workstations, real-world risk is minimal. The CVSS vector and SSVC are internally consistent; no conflicting signals require flagging.

A low-privileged user already logged on to an unpatched Windows system - via a local account, RDP session, or as a result of prior initial access - invokes Windows CNG API calls that trigger the information disclosure flaw, reading sensitive cryptographic material (such as private keys or certificate data) that belongs to a higher-privileged process or the system itself. Because the attack is local and non-automatable per SSVC, the most realistic threat actor is a malicious insider, a compromised service account on a shared server, or an attacker who has achieved initial foothold and is seeking to harvest cryptographic credentials for lateral movement. No public proof-of-concept code has been identified at the time of analysis.