Microsoft Windows CVE-2026-50372

Exploitation requires the attacker to already hold a valid low-privileged local account and to be able to execute code on the target host (PR:L, AV:L, no user interaction), and to reach the Redirected Drive Buffering Subsystem (RDBSS) code path. The key limiting factor is high attack complexity (AC:H): the attacker must satisfy specific timing or memory-layout conditions to reliably trigger the over-read, so exploitation is not guaranteed on every attempt. There is no remote, unauthenticated, or default-configuration path - the flaw cannot be reached over the network without first gaining local authenticated access, which narrows realistic exploitation to hosts where untrusted users already have a foothold (e.g., RDP/terminal servers, shared workstations).

The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.0) describes a locally exploitable, authenticated bug with high attack complexity but full CIA impact within an unchanged scope. High attack complexity (AC:H) and the requirement for existing low-privilege access (PR:L) meaningfully raise the bar: an attacker must already have a foothold on the host and typically win a race or satisfy specific memory-state conditions, so this is a post-compromise escalation primitive rather than an initial-access or remotely-wormable flaw. It is not in CISA KEV, no EPSS score was supplied, and no POC is referenced, so real-world exploitation pressure currently appears low-to-moderate. That said, RDBSS local-EoP bugs are historically attractive to malware and post-exploitation toolkits because they grant kernel/SYSTEM privileges, so it should be treated as a genuine patch-priority for multi-user, RDP, and server hosts even though it is not a drop-everything emergency. No conflicting signals were observed: the description (local EoP) and the CVSS vector (AV:L) agree.

An attacker who has already obtained low-privileged access to a Windows host - for example through phishing, a compromised service account, or a shared terminal server - runs a crafted program that drives the RDBSS driver into reading past a buffer boundary. By satisfying the required memory-state conditions (reflecting the high attack complexity), they leverage the kernel over-read to disclose kernel memory or corrupt kernel state and escalate to SYSTEM. No public POC is currently identified, so this scenario is presently theoretical rather than observed.