Windows Kernel CVE-2026-50463

Per CVSS AV:N/AC:L/PR:N/UI:N, exploitation requires no authentication, no user interaction, and only network reachability to the affected Windows Kernel service on a supported build (Windows 10 1809/21H2/22H2, Windows 11 24H2/25H2/26H1, or Windows Server 2019/2022/2025). The description does not name a specific feature, protocol, or non-default configuration that must be enabled, so no special toggle is documented as a prerequisite; the primary limiting factor is that the attacker must be able to reach the vulnerable kernel-facing network endpoint, and impact is confined to information disclosure (C:H, I:N, A:N) rather than code execution or system compromise. Because the vector is stated as network but Windows Kernel OOB reads are frequently local in practice, confirm the actual network-reachable entry point against Microsoft's MSRC advisory before assuming remote unauthenticated access holds in a given deployment.

The signals are moderately consistent but incomplete. CVSS 3.1 rates this 7.5 (High) driven entirely by C:H, with I:N and A:N - it is a pure confidentiality/information-disclosure issue, not RCE or DoS. The vector AV:N/AC:L/PR:N/UI:N indicates a network-reachable, low-complexity, unauthenticated, no-interaction path, which normally correlates with higher real-world exploitability. However, no EPSS score was supplied, this is not in CISA KEV, and no POC is referenced, so there is no evidence of active or imminent exploitation. Note a tension worth verifying: many Windows Kernel OOB-read bugs are practically reached via crafted network protocol traffic or an intermediate service, and pure kernel bugs are often local - the AV:N here should be confirmed against Microsoft's MSRC advisory to ensure the network vector is genuine and not an artifact of scoring. Overall this is a real, widely-applicable patch priority because of ubiquity and the unauthenticated network vector, but the confidentiality-only impact and absence of exploitation evidence place it below wormable RCE-class emergencies.

An attacker with network access to an affected Windows host sends crafted traffic to a kernel-serviced endpoint that triggers the out-of-bounds read, causing the kernel to return adjacent memory contents in a response or observable side channel. Repeating the request lets the attacker harvest sensitive memory such as pointers or secrets, potentially bypassing address-space randomization to enable follow-on attacks. No public POC is referenced, and success depends on the low-complexity network path indicated by the CVSS vector.