EUVD-2026-43883
GHSA-5w93-7gfv-q5cv
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local attack requiring authenticated low-privilege session (AV:L, PR:L); confidentiality-only impact with no integrity or availability effect confirmed by description.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker to disclose information locally.
AnalysisAI
Sensitive information disclosure in Windows Push Notifications allows a locally authenticated standard user to access notification data they are not authorized to view across Windows 10, Windows 11, and Windows Server 2022/2025 platforms. The flaw (CWE-200) requires only low-privilege local access - no elevated rights or user interaction - making it exploitable by any interactive user on a vulnerable host. No public exploit code exists at time of analysis, and both EPSS (0.36%, 28th percentile) and SSVC (exploitation: none, automatable: no) signals indicate low near-term weaponization risk despite the high confidentiality impact rating.
Technical ContextAI
The Windows Push Notifications (WPN) subsystem is a platform-level service built into Windows 10 and Windows 11 consumer and enterprise editions, as well as Windows Server 2022 and 2025, responsible for delivering app and system notifications to users. The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating that the notification service fails to properly enforce access controls on notification data, allowing one local user or process to read data intended for another. CPE strings confirm the affected scope spans cpe:2.3:a:microsoft:windows_10_version_21h2 through cpe:2.3:a:microsoft:windows_server_2025_(server_core_installation). The CVSS vector AV:L/AC:L/PR:L reflects that exploitation is local-only, requires no special configuration or elevated privileges, and involves no scope crossing (S:U) - the vulnerable component itself exposes the data without impacting external systems.
RemediationAI
Apply the vendor-released patches distributed through the Microsoft Security Response Center update cycle, available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50434. Exact fixed build numbers confirmed via EUVD data are: Windows 10 21H2 → 10.0.19044.7548; Windows 10 22H2 → 10.0.19045.7548; Windows 11 24H2 → 10.0.26100.8875; Windows 11 25H2 → 10.0.26200.8875; Windows 11 26H1 → 10.0.28000.2269; Windows Server 2022 → 10.0.20348.5386; Windows Server 2025 and Server Core → 10.0.26100.33158. Where immediate patching is not feasible - particularly on Windows Server RDS or VDI environments with untrusted local users - restrict interactive local logon rights to only authorized accounts via Group Policy (Deny log on locally / Deny log on through Remote Desktop Services), which eliminates the PR:L attack surface. Note that disabling or heavily restricting the Push Notifications service via Group Policy (Computer Configuration → Administrative Templates → Start Menu and Taskbar → Notifications) may prevent application notification delivery as a side effect. Patching remains the definitive fix.
More in Windows 10 Version 21H2
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker corrupt kernel memory via a use-
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Local privilege escalation in the Microsoft Windows Kernel allows an already-authenticated attacker to elevate to SYSTEM
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today