EUVD-2026-44089
GHSA-8c44-h2jq-c85w
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local EoP requiring an existing low-privileged session (AV:L, PR:L), low complexity and no user interaction, with full C/I/A impact from privilege elevation to SYSTEM.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows Web Proxy Auto-Discovery Protocol (WPAD) allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows Web Proxy Auto-Discovery (WPAD) service affects Windows 10 Version 1607 and Windows Server 2012, 2012 R2, and 2016 (including Server Core installations), where a heap-based buffer overflow (CWE-122) lets an authenticated local attacker corrupt kernel/service heap memory and elevate to higher privileges. Microsoft has released a patch and reported the flaw itself; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N) reflecting a high-impact but locally-scoped attack requiring existing low-privilege access.
Technical ContextAI
The vulnerability resides in Windows' implementation of the Web Proxy Auto-Discovery Protocol (WPAD), the mechanism by which Windows clients automatically locate a proxy configuration (PAC) file via DHCP/DNS and then interpret it to route web traffic. WPAD handling has historically been a rich attack surface because it parses attacker-influenceable network and configuration data. The root cause is classified as CWE-122, a heap-based buffer overflow: undersized heap allocation or missing bounds checking during WPAD data processing allows adjacent heap memory to be overwritten. On modern Windows, controlled heap corruption of this kind can be groomed into arbitrary code execution or a control-flow hijack in the context of the affected service, yielding privilege elevation. The affected CPE set spans client (Windows 10 1607) and server SKUs (Server 2012 through 2016, including Server Core), indicating the flawed code path is present across a shared WPAD/proxy component in these releases.
RemediationAI
Patch available per vendor advisory: Microsoft has released fixes for the affected SKUs, so the primary action is to install the corresponding monthly security update (KB) for each affected system via Windows Update or WSUS, prioritizing multi-user and internet-adjacent hosts. The exact fixed build numbers are not included in the input data and must be obtained from the Microsoft Security Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50480 - do not rely on assumed version numbers. As a compensating control where immediate patching is not possible, disabling WPAD reduces exposure: set the WinHTTP/WinINET auto-proxy discovery off (disable the 'Automatically detect settings' option, disable the WinHTTPAutoProxySvc dependency where feasible, or block WPAD via a Group Policy that pins explicit proxy settings), and add a 'wpad' DNS block / hosts entry; the trade-off is that clients relying on automatic proxy discovery will lose transparent proxy configuration and must be given static proxy settings. Because this is a local EoP, also tighten who can obtain interactive/low-privilege sessions on the affected servers (restrict RDP and local logon rights) to limit the pool of potential attackers.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today