EUVD-2026-43904
GHSA-x47j-8c8r-mqm2
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Local authenticated access required (AV:L, PR:L); no user interaction or scope change; only partial confidentiality disclosed with zero integrity or availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an authorized attacker to disclose information locally.
AnalysisAI
Windows Win32K in Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025 leaks sensitive information to local authenticated attackers through an information disclosure flaw classified as CWE-200. The vulnerability requires only low-privilege local access and yields partial confidentiality impact with no integrity or availability consequences, consistent with the CVSS 3.3 Low rating. No public exploit identified at time of analysis, and CISA SSVC assessment confirms no known exploitation, non-automatable attack pattern, and only partial technical impact - making this a low real-world priority outside multi-tenant or shared-access environments.
Technical ContextAI
Win32K (win32k.sys) is a kernel-mode driver at the core of the Windows graphics and user interface subsystem, responsible for window management, GDI rendering, and user input handling. Because Win32K operates in kernel mode, any unintended exposure of data it processes carries risk of leaking privileged memory contents, kernel object handles, or address-space information to lower-privileged callers. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) identifies the root cause as improper access control over sensitive data - the kernel component fails to sufficiently restrict what information is returned to a calling process operating at lower privilege. CPE data confirms the flaw spans five distinct product configurations: cpe:2.3:a:microsoft:windows_11_version_24h2, windows_11_version_25h2, windows_11_version_26h1, windows_server_2025, and windows_server_2025_(server_core_installation), with EUVD-2026-43904 providing specific affected build ranges.
RemediationAI
Apply the Microsoft-released patch via Windows Update or Windows Server Update Services targeting the following minimum build versions: Windows 11 24H2 at 10.0.26100.8875 or later, Windows 11 25H2 at 10.0.26200.8875 or later, Windows 11 26H1 at 10.0.28000.2525 or later, and Windows Server 2025 (including Server Core) at 10.0.26100.33158 or later. Full patch guidance is documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50416. As an interim compensating control on high-value systems where patching cannot be immediately applied, restrict interactive local logon rights to only trusted administrators using Group Policy (User Rights Assignment: Deny log on locally), reducing the pool of principals who could exploit this flaw - note this may break legitimate user workflows on shared systems. Least-privilege enforcement (removing unnecessary local user group memberships) further limits exposure without operational impact. These controls do not eliminate the vulnerability and are not substitutes for patching.
More in Windows Server 2025
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
MSHTML Framework contains a protection mechanism failure (CVE-2026-21513, CVSS 8.8) allowing remote attackers to bypass
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today