EUVD-2026-44112
GHSA-66hc-h9hh-629w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description states network information disclosure with no auth (AV:N/PR:N/UI:N/AC:L); an OOB read leaking memory maps to C:H with no integrity or availability impact, diverging from the input's A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Windows Network Policy Server SNMP allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Information disclosure in the Windows Network Policy Server (NPS) SNMP handling allows a remote, unauthenticated attacker to read out-of-bounds memory over the network and disclose potentially sensitive data. The flaw affects a broad range of Windows Server (2012 through 2025) and Windows client builds where the NPS role/SNMP component is present. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available from Microsoft (MSRC).
Technical ContextAI
The vulnerability is an out-of-bounds read (CWE-125) in the SNMP-related processing path of the Windows Network Policy Server, Microsoft's RADIUS server and network access policy component used for 802.1X, VPN, and RADIUS authentication infrastructure. CWE-125 arises when code reads memory outside the bounds of an allocated buffer - typically due to missing or incorrect length validation when parsing attacker-controlled network input (here, SNMP protocol data). The CPE set covers Microsoft OS platforms including Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012 through 2025, indicating the affected code is part of a shared Windows networking/SNMP component rather than a standalone product.
RemediationAI
Apply the Microsoft security update for CVE-2026-50496 - patch available per vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50496, which lists the specific KB/build numbers for each affected Windows 10/11 and Windows Server 2012-2025 SKU; no single fix version string was provided in the input, so pull the exact build from the MSRC update guide for your platform. As compensating controls until patching, restrict network reachability of the NPS/SNMP service by blocking SNMP (UDP 161/162) at the perimeter and internal firewalls except from trusted management hosts, and limit access to the RADIUS/NPS servers to authorized network-management subnets; note the trade-off that blocking SNMP will disrupt legitimate SNMP monitoring of those hosts. Where the SNMP service is not required on NPS servers, disabling the SNMP Service role reduces attack surface entirely, at the cost of losing SNMP-based monitoring for that server.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today