EUVD-2026-43853
GHSA-j5rm-m6wv-77vq
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local privilege escalation requiring a low-privileged foothold (AV:L/PR:L) with no user interaction; successful exploitation yields SYSTEM control, giving full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows Push Notifications component (WNS/WpnService) lets an already-authenticated low-privileged user overwrite adjacent heap memory to gain SYSTEM-level control across Windows 10 (1607-22H2), Windows 11 (24H2-26H1), and Windows Server 2012 R2 through 2025. Microsoft reported the flaw and has shipped a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The high CVSS 7.8 reflects full confidentiality, integrity, and availability impact once triggered, but exploitation requires prior local access.
Technical ContextAI
Windows Push Notifications (the Windows Push Notification Service client stack, typically surfaced through WpnService/WpnUserService) handles toast and raw notification payloads for local applications and processes them in a shared, privileged service context. The root cause is CWE-122, a heap-based buffer overflow: memory is allocated on the heap and a length or bounds check is mishandled when parsing or copying notification data, allowing a write past the end of the allocated buffer. Corrupting heap metadata or an adjacent object in a service running at higher privilege is a classic path to code execution or privilege elevation. The CPE set scopes this to the Microsoft Windows OS itself rather than a third-party product, spanning both client (Windows 10/11) and server (2012 R2 through 2025, including Server Core installations).
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-50363 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50363), selecting the cumulative update that matches each affected build; the input confirms a patch is available from the vendor but does not enumerate exact KB or build numbers, so pull the precise fixed version per OS from the MSRC guide. Because this is an OS-level component, prioritize the monthly cumulative update through Windows Update or WSUS/Autopatch and reboot to complete installation. No official workaround is provided by Microsoft for this component; as a compensating control until patching, restrict local access and enforce least privilege so untrusted or low-privileged users cannot run code on affected hosts, and monitor for anomalous behavior in the push notification service (WpnService/WpnUserService) - note these are containment measures only and do not remove the vulnerable code path.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today