EUVD-2026-44107
GHSA-fwc5-hhf3-xf48
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authenticated low-privilege foothold, no user interaction (AV:L/PR:L/UI:N); kernel-context Code Integrity flaw yields full SYSTEM compromise, so C/I/A all High.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Out-of-bounds read in Code Integrity DLL (ci.dll) allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows Code Integrity module (ci.dll) allows an already-authenticated, low-privileged user on affected Windows 10, Windows 11, and Windows Server builds to read memory outside intended bounds and gain SYSTEM-level control. Microsoft has shipped patches and rates real-world impact as total (full confidentiality, integrity, and availability loss on the host), but the flaw requires prior local access and there is no public exploit identified at time of analysis. EPSS is low (0.25%, 16th percentile) and CISA SSVC lists exploitation as none, indicating this is an important patch-cycle item rather than an emergency.
Technical ContextAI
The vulnerable component is ci.dll, the Windows Code Integrity engine responsible for validating driver and binary signatures and enforcing kernel-mode code-signing policies (including Driver Signature Enforcement and, on hardened systems, HVCI/Memory Integrity). The root cause is CWE-125 (out-of-bounds read): ci.dll parses attacker-influenceable data and reads past the end of an allocated buffer. Because Code Integrity runs in kernel context, leaked memory or corrupted control flow in this component translates directly into a privilege boundary crossing. The CPE and EUVD data confirm the affected surface spans the full supported Windows family - client (Windows 10 1607/1809/21H2/22H2 and Windows 11 24H2/25H2/26H1) and server (Server 2012 through Server 2025, including Server Core installations).
RemediationAI
Apply the Microsoft security update that raises ci.dll to at least the fixed build for each release: 10.0.14393.9339 (1607/Server 2016), 10.0.17763.9020 (1809/Server 2019), 10.0.19044.7548 (21H2), 10.0.19045.7548 (22H2), 10.0.20348.5386 (Server 2022), 10.0.26100.8875 (Windows 11 24H2) / 10.0.26100.33158 (Server 2025), 10.0.26200.8875 (25H2), 10.0.28000.2525 (26H1), 6.2.9200.26226 (Server 2012), and 6.3.9600.23291 (Server 2012 R2), per the vendor guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50491. This is a Vendor-released patch delivered through the normal cumulative/monthly update channel, so ensure Windows Update or WSUS/SCCM rings are current and reboot to complete installation. There is no vendor-documented in-product workaround for a Code Integrity parsing flaw; if patching must be deferred, reduce exposure by tightening local access - restrict interactive/RDP logon rights to trusted admins, remove unnecessary standard-user accounts from multi-user and jump hosts, and enforce application allowlisting (WDAC/AppLocker) to limit which unsigned local binaries can run and attempt to trigger the flaw. These controls narrow who can obtain the required local foothold but do not remove the underlying out-of-bounds read, so patching remains the only complete fix.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today