Windows Kernel CVE-2026-50419

Exploitation requires a locally authenticated user account with at minimum standard (low-privilege) user rights on the target system - this is confirmed by the CVSS vector PR:L and the description phrase 'authorized attacker.' No network exposure is required (AV:L); the attacker must have an interactive or programmatic session on the affected host, such as via local login, RDP, SSH, or a running process under a low-privileged service account. No specific non-default Windows configuration or optional feature appears required based on available data - the vulnerable code path is in the Windows Kernel itself and is presumed present on all affected builds regardless of role configuration. Exploitation is limited by: (1) the requirement for local authenticated access, preventing remote unauthenticated exploitation; (2) impact confined to confidentiality only with no write or execution primitive; and (3) SSVC 'not automatable,' meaning mass automated exploitation is not viable.

Real-world risk for this vulnerability is low to moderate in practical terms despite the breadth of the affected product surface. The CVSS 3.3 base score reflects genuinely limited impact: local access required (AV:L), low privileges needed (PR:L), and only partial confidentiality loss (C:L) with no integrity or availability impact. The EPSS score of 0.35% at the 27th percentile signals the broader security community assigns low near-term exploitation probability. CISA SSVC corroborates this: Exploitation status is 'none,' the vulnerability is not automatable, and technical impact is partial. There is no KEV listing. The primary concern is that kernel information disclosures are frequently chained with privilege escalation vulnerabilities - leaked kernel addresses can be used to defeat ASLR, enabling a second exploit to land a reliable privilege escalation. Defenders in environments with untrusted local users (shared servers, VDI, terminal services) should treat this with higher urgency than the raw CVSS implies. No signals conflict in this dataset; all sources are consistent.

A low-privileged local user on a shared Windows Server 2019 terminal services environment invokes a vulnerable kernel system call or IOCTL, causing the kernel to return a buffer containing uninitialized or improperly scoped kernel memory. The attacker parses the leaked data to recover a kernel virtual address, defeating kernel ASLR (KASLR), and then combines this information with a separate local privilege escalation exploit to achieve SYSTEM-level code execution. No public exploit code for this specific CVE has been identified at time of analysis, so exploitation today requires independent vulnerability research to identify the precise triggering code path.