EUVD-2026-44064
GHSA-hph8-fxwm-fq7q
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local attack vector and low privileges confirmed; high confidentiality impact from kernel data read; no integrity or availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Windows Quality of Service (QoS) Packet Scheduler Information Disclosure Vulnerability
AnalysisAI
Information disclosure in the Windows Quality of Service (QoS) Packet Scheduler component exposes sensitive data to locally authenticated low-privileged users across a wide range of Windows client and server releases. The flaw (CWE-200) allows a local attacker with standard user access to read memory or network-related data that should be restricted to higher-privilege contexts. No public exploit exists and SSVC classifies exploitation as none with partial technical impact, but the breadth of affected Windows versions - from Server 2012 through Windows 11 26H1 and Server 2025 - makes patching a broad operational priority.
Technical ContextAI
The Windows QoS Packet Scheduler (pacer.sys) is a kernel-mode driver responsible for managing network traffic prioritization and bandwidth allocation on Windows systems. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) indicates that the scheduler fails to properly restrict what data a low-privileged caller can access, likely via an improperly validated IOCTL interface or insufficient access control on kernel objects exposed to user-mode. CPE data confirms the flaw is present across the entire modern Windows product line: Windows 10 versions 1607 through 22H2, Windows 11 versions 24H2 through 26H1, and Windows Server 2012 through Server 2025. The CVSS local attack vector (AV:L) confirms that exploitation occurs through local process interaction with the kernel driver rather than over a network.
RemediationAI
Apply the vendor-released patch via Windows Update or WSUS targeting the fixed builds listed per platform: Windows 10 1607 and Server 2016 to build 10.0.14393.9339 or later; Windows 10 1809 and Server 2019 to 10.0.17763.9020 or later; Windows 10 21H2 to 10.0.19044.7548 or later; Windows 10 22H2 to 10.0.19045.7548 or later; Windows 11 24H2 to 10.0.26100.8875 or later; Server 2025 to 10.0.26100.33158 or later; Windows 11 25H2 to 10.0.26200.8875 or later; Windows 11 26H1 to 10.0.28000.2269 or later; Server 2022 to 10.0.20348.5386 or later; Server 2012 to 6.2.9200.26226 or later; and Server 2012 R2 to 6.3.9600.23291 or later. The advisory is published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50431. Where immediate patching is not possible, restrict interactive and remote desktop logon rights to the minimum necessary set of users on affected systems, as the attack requires local authenticated access. Note that disabling the QoS Packet Scheduler entirely may impact network traffic prioritization for applications relying on DSCP tagging.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today