Windows Kernel CVE-2026-50429

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions and no authentication or user interaction are required - an unauthenticated remote attacker can trigger the out-of-bounds read over a network against affected default Windows Kernel builds. The practical limiting factor is network reachability of the specific kernel-facing component that processes attacker input: the host must be reachable on the relevant service, so segmented, firewalled, or non-internet-facing systems are substantially harder to reach. Exploitation is further bounded to information disclosure (C:H, I:N) with only a minor availability effect (A:L), meaning success leaks memory rather than granting code execution or data modification. The description does not name the exact triggering protocol or service, which should be confirmed against the MSRC advisory to scope which listening services must be exposed.

The signals point to a real, prioritizable issue rather than a paper high-CVSS finding. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L, base 8.2) describes a low-complexity, network-reachable, unauthenticated attack requiring no user interaction, which maximizes exposure; impact is confined to confidentiality (C:H) with a minor availability effect (A:L) and no integrity impact. Offsetting this, no EPSS score, SSVC decision data, or POC was supplied, and the CVE is not in CISA KEV, so there is no evidence of active or automatable exploitation yet. One point warrants verification: an unauthenticated network-facing out-of-bounds read in the kernel is unusual and typically depends on a reachable network-facing kernel service or parser, yet the description does not name the specific triggering component - verify the exact remote path against the Microsoft advisory. Absent EPSS and exploit-maturity data, treat this as a high-severity patch-soon item, escalating to urgent only where the affected component is internet-exposed.

An attacker with network reachability to a vulnerable Windows host sends a crafted request to the affected kernel-facing service, triggering an out-of-bounds read that returns adjacent kernel memory in the response. The leaked data - potentially pointers or secrets - can be harvested to bypass KASLR or stage a follow-on exploit. Given AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is needed, though no public POC has been identified at time of analysis.