EUVD-2026-44129
GHSA-m4mq-5mc2-xrjv
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authenticated foothold (AV:L/PR:L), race-like preconditions give AC:H, no victim interaction (UI:N); kernel compromise crossing the security boundary gives S:C with full C:H/I:H/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Null pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Microsoft Windows Kernel lets an authenticated attacker gain elevated (SYSTEM-level) privileges by triggering a NULL pointer dereference (CWE-476) in kernel-mode code. The flaw affects a broad range of client and server builds from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Reported by Microsoft with a patch available; no public exploit identified at time of analysis.
Technical ContextAI
The vulnerability resides in the Windows Kernel (the ring-0 executive that mediates memory, scheduling, and hardware access for all user-mode processes). CWE-476 (NULL Pointer Dereference) means kernel code follows a pointer that has not been validated as non-null before use; in kernel context this normally causes a bugcheck (denial of service), which is consistent with the 'Denial Of Service' tag on this record, but Microsoft classifies the outcome as elevation of privilege, implying the dereference is exploitable to redirect execution or corrupt kernel state rather than merely crash. The affected CPE set spans Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012/2012 R2/2016/2019/2022/2025 including Server Core installations, indicating a defect in a long-lived, shared kernel component present across many years of builds.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-50673 for your specific Windows build via Windows Update or WSUS/SCCM, using the per-version KB listed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50673 (exact fixed build numbers were not included in the provided data - do not assume a version). Because exploitation requires local authenticated access, interim compensating controls that reduce risk until patching are to restrict and monitor interactive and remote-shell logon rights on servers (limits which principals can run the local trigger, at the cost of tighter operational access), enforce least privilege so fewer accounts hold the standard-user foothold an attacker would leverage, and prioritize patching multi-user and RDP/session-host systems where untrusted authenticated users are most likely. No feature-toggle workaround was identified for this kernel defect, so patching is the definitive fix.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today