Microsoft Windows CVE-2026-50491

Exploitation requires the attacker to already have authenticated local code-execution on the target (PR:L, AV:L) - this is a local privilege-escalation primitive, not a remote entry point, so it must be chained after an initial foothold such as phished credentials, a malicious document/binary, or a compromised low-privilege service. No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning that once local access is held the out-of-bounds read in ci.dll can be triggered reliably against default configurations of the listed Windows builds; no special product feature or non-default setting must be enabled. Limiting factors that reduce real-world risk: the need for prior local access, the local-only attack vector (no network exploitation), the absence of any known active exploitation or public POC, and that fully-patched builds are not affected.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8 High) and the SSVC judgment agree that this is a locally-exploited flaw with total technical impact but no scope change and no network reach. The signals are internally consistent and point to moderate operational urgency: EPSS is only 0.25% (16th percentile), SSVC exploitation status is 'none', Automatable is 'no', and there is no KEV listing or public POC - so this is not currently under active or automated exploitation. The 'total' technical impact and the sensitivity of the Code Integrity component are what keep it a genuine priority: a low-privileged foothold (malware, a compromised standard user, a low-rights service) can be chained into full SYSTEM compromise. Bottom line: prioritize in the normal Patch-Tuesday cycle, elevated on multi-user, RDP/terminal, or shared-workstation hosts where untrusted local sessions exist; it is not a drop-everything network emergency.

An attacker who already has a low-privileged foothold on a Windows host - for example, a standard domain user on a shared workstation or a compromised low-rights service - runs a crafted local process that feeds malformed input into the Code Integrity path in ci.dll, triggering the out-of-bounds read to escalate from limited user to SYSTEM. Because the CVSS vector is AV:L/AC:L/PR:L/UI:N, no user interaction and no special timing are needed once local access exists, though the attacker must first obtain that initial local session. No public exploit identified at time of analysis.