EUVD-2026-43936
GHSA-r64q-4mrv-xx3v
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local attack vector and low-privilege requirement are independently consistent with the description; high confidentiality impact reflects cryptographic material exposure; no integrity or availability impact applies.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Exposure of sensitive information to an unauthorized actor in Windows Cryptographic Services allows an authorized attacker to disclose information locally.
AnalysisAI
Windows Cryptographic Services across all supported Microsoft Windows client and server editions exposes sensitive cryptographic material to locally authenticated low-privilege users through a CWE-200 information disclosure flaw. Spanning Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025, the vulnerability allows an attacker with a standard local account to read confidential data - likely cryptographic keys, certificates, or intermediate cryptographic state - without any user interaction. SSVC rates exploitation as none, EPSS at 0.47% (38th percentile) indicates low near-term exploitation probability, and no active exploitation has been confirmed by CISA KEV, positioning this as a routine patch-cycle priority rather than an emergency response.
Technical ContextAI
Windows Cryptographic Services encompasses the Cryptography Next Generation (CNG) subsystem, which provides key management, certificate operations, and algorithm implementations used broadly across Windows and by third-party applications. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) identifies the root cause as a failure to properly restrict access to sensitive cryptographic state when accessed by a low-privileged local process - typical manifestations include improper handle permissions, insufficient ACLs on memory-mapped regions, or unguarded CNG API calls that return data the caller should not be authorized to read. The CPE data confirms the flaw spans cpe:2.3:a:microsoft:windows_10_version_1607 through cpe:2.3:a:microsoft:windows_11_version_26h1 and cpe:2.3:a:microsoft:windows_server_2012 through Server 2025, indicating the vulnerable code path has persisted across more than a decade of Windows development and updates. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N is technically coherent with this description: local access only, no complexity barrier, one-directional confidentiality impact with no write or availability component.
RemediationAI
Apply Microsoft's security update for CVE-2026-50352 via Windows Update or the Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50352. Fixed builds confirmed by EUVD version data are: Windows 10 1607 and Server 2016 to build 10.0.14393.9339 or later; Windows 10 1809 and Server 2019 to build 10.0.17763.9020 or later; Windows 10 21H2 to build 10.0.19044.7548 or later; Windows 10 22H2 to build 10.0.19045.7548 or later; Windows 11 24H2 to build 10.0.26100.8875 or later; Windows 11 25H2 to build 10.0.26200.8875 or later; Windows 11 26H1 to build 10.0.28000.2269 or later; Windows Server 2012 to build 6.2.9200.26226 or later; Windows Server 2012 R2 to build 6.3.9600.23291 or later; Windows Server 2022 to build 10.0.20348.5386 or later; and Windows Server 2025 to build 10.0.26100.33158 or later. Where immediate patching is blocked, restrict interactive local logon rights on systems handling sensitive cryptographic material to the minimum necessary accounts - note this reduces the attacker pool but does not eliminate the vulnerability, and it may limit legitimate administrative workflows. Windows Server 2012 and 2012 R2 are past end of standard support; organizations still running these should apply the patch through Microsoft's Extended Security Update (ESU) program and treat migration as urgent.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today