EUVD-2026-44102
GHSA-ggf5-x436-r699
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local escalation from an existing low-privileged user with no interaction (AV:L/PR:L/UI:N), reliable overflow (AC:L), yielding full SYSTEM control (C/I/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionNVD
Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap memory (CWE-122) to gain SYSTEM-level control across virtually all supported Windows client and server builds. Publicly available exploit code exists, though CISA SSVC assessed exploitation status as none and EPSS is modest (0.37%, 29th percentile), indicating a serious but not yet mass-exploited weakness. A vendor patch is available via Microsoft's update guide, making prompt patching the clear priority.
Technical ContextAI
Win32K is the kernel-mode subsystem (win32k.sys / win32kbase.sys / win32kfull.sys) that services the Windows GUI, window manager, and GDI, and it has historically been a rich source of local escalation bugs because it runs in ring 0 yet is reachable from user-mode syscalls. The flaw is a CWE-122 heap-based buffer overflow, meaning a size-miscalculated or unchecked copy into a dynamically allocated kernel pool buffer overwrites adjacent heap structures. By grooming the kernel pool and overflowing controlled data, an attacker can corrupt object headers or function pointers to hijack kernel execution. The CPE and EUVD data confirm the affected component ships in every current Windows edition from the legacy Windows Server 2012 / 8.1-era 6.2/6.3 kernels through Windows 11 26H1 and Windows Server 2025 (10.0.28000/26100 builds).
RemediationAI
Apply the Microsoft security update for CVE-2026-50489 via the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50489; the fixed builds are edition-specific (Vendor-released patch: e.g. Windows 11 24H2 10.0.26100.8875, 25H2 10.0.26200.8875, 26H1 10.0.28000.2525, Server 2022 10.0.20348.5386, Server 2025 10.0.26100.33158, Server 2019/Win10 1809 10.0.17763.9020, Server 2016/Win10 1607 10.0.14393.9339, Server 2012 R2 6.3.9600.23291, Server 2012 6.2.9200.26226), so verify each host reaches at or above its listed build. Because exploitation requires an attacker to already run code as a local user, the strongest compensating control while patching is reducing local footholds: enforce least privilege, remove standard users' ability to run untrusted binaries (application allowlisting such as WDAC/AppLocker), and monitor EDR for Win32K exploitation and suspicious token/SYSTEM elevation - note that allowlisting can disrupt legitimate line-of-business tools and requires tuning. There is no documented Microsoft-provided feature toggle to disable Win32K, so patching is the only complete fix; additional references include the NVD detail page https://nvd.nist.gov/vuln/detail/CVE-2026-50489.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Remote code execution in Microsoft Windows Message Queuing (MSMQ) allows an unauthenticated attacker to run arbitrary co
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today