EUVD-2026-44092
GHSA-276x-mfrj-hmjg
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local attack requiring standard user credentials; confidentiality impact is high while integrity and availability are unaffected, consistent with a read-only information disclosure flaw.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Exposure of sensitive information to an unauthorized actor in Microsoft Graphics Component allows an authorized attacker to disclose information locally.
AnalysisAI
Microsoft Graphics Component on Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025 leaks sensitive information to locally authenticated standard users. Exploitation requires existing local access with at least user-level privileges (PR:L, AV:L), after which the attacker can extract sensitive data through the Graphics Component without any user interaction. No active exploitation has been confirmed - SSVC categorizes exploitation as 'none,' CISA KEV listing is absent, and EPSS of 0.35% (27th percentile) reflects low near-term exploitation probability.
Technical ContextAI
The Microsoft Graphics Component is a core Windows subsystem responsible for graphics rendering, display management, and handling of graphical data structures such as device contexts, bitmaps, and graphics driver interfaces. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) identifies the root cause class as a failure to enforce access controls on sensitive data - in this context, likely memory contents, kernel-resident graphics structures, or driver-level data accessible through a user-mode API or system call surface. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U) is consistent with a vulnerability in a Graphics Component driver or Win32 subsystem call that does not adequately sanitize or restrict data returned to user-space callers. Affected CPEs confirm scope to Windows 11 builds on the 26100.x and 28000.x kernel lines, and Windows Server 2025 on the same 26100.x line.
RemediationAI
Apply the Microsoft security update documented in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50483. The confirmed fixed builds per ENISA EUVD-2026-44092 are: Windows 11 24H2 - update to build 10.0.26100.8875 or later; Windows 11 25H2 - update to build 10.0.26200.8875 or later; Windows 11 26H1 - update to build 10.0.28000.2269 or later; Windows Server 2025 and Server Core - update to build 10.0.26100.33158 or later. Where immediate patching is not feasible, enforce strict least-privilege access controls to limit which users have interactive or remote-desktop access to affected systems, reducing the population of users who could trigger the disclosure; note this does not eliminate the underlying flaw. Prioritize patching on multi-user systems, RDS servers, and Windows Server 2025 environments where untrusted or semi-trusted local sessions are common.
More in Windows 11 Version 24H2
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker corrupt kernel memory via a use-
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Local privilege escalation in the Microsoft Windows Kernel allows an already-authenticated attacker to elevate to SYSTEM
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today