EUVD-2026-43891
GHSA-mx2f-6cc2-54mh
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authenticated low-priv user triggers a reliable kernel over-read (AV:L/PR:L/AC:L/UI:N) that escalates to SYSTEM, yielding full C/I/A impact within the OS scope.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Microsoft Windows Kernel (CVE-2026-50377) lets an already-authenticated low-privileged attacker read memory outside intended bounds and leverage it to gain SYSTEM-level rights across a broad range of Windows 10, Windows 11, and Windows Server builds. Microsoft has released patches and rates it 7.8 (High); there is no public exploit identified at time of analysis, EPSS is low at 0.40% (32th percentile), and CISA SSVC records exploitation as none. It is a strong second-stage escalation primitive for attackers who already have a foothold, but not a remotely reachable, wormable threat.
Technical ContextAI
The flaw is an out-of-bounds read (CWE-125) in the Windows Kernel - the core ntoskrnl component that mediates memory management, scheduling, and the boundary between user mode and kernel mode. An out-of-bounds read occurs when code accesses memory past the end (or before the start) of a validated buffer, typically because a length or index check is missing or incorrect when handling attacker-influenced input crossing the syscall/IOCTL boundary. Although the primary CWE and vendor tag describe information disclosure/buffer over-read, the assigned CVSS reflects high confidentiality, integrity, and availability impact, indicating the leaked kernel data (e.g., pointers defeating KASLR, or sensitive tokens) can be chained into full privilege elevation. The CPE set confirms the affected surface is the OS kernel itself across Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2016/2019/2022/2025, including Server Core installations.
RemediationAI
Apply the Microsoft security update for your specific Windows build via Windows Update or WSUS; the fix is confirmed available from the vendor (Vendor-released patch per MSRC advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50377). Upgrade to at least the fixed build for each SKU: Windows 10 1607/Server 2016 to 10.0.14393.9339, Windows 10 1809/Server 2019 to 10.0.17763.9020, Windows 10 21H2 to 10.0.19044.7548, 22H2 to 10.0.19045.7548, Windows 11 24H2 to 10.0.26100.8875, 25H2 to 10.0.26200.8875, 26H1 to 10.0.28000.2525, Windows Server 2022 to 10.0.20348.5386, and Windows Server 2025 to 10.0.26100.33158. There is no vendor-published configuration workaround for a kernel over-read, so if immediate patching is not possible, apply compensating controls: restrict interactive and RDP logon rights so untrusted users cannot obtain the local foothold this bug requires (trade-off: may disrupt shared/terminal-server workflows), enforce least privilege and application allowlisting to block the attacker's exploit binary from executing (trade-off: allowlist tuning overhead), and prioritize patching multi-user, jump-host, and Server Core hosts where local accounts are most exposed.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today