EUVD-2026-44144
GHSA-qrhv-vrqx-88v2
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-delivered crafted OLE object with no auth (PR:N) but a hard-to-control memory state (AC:H) yielding full code execution (C:H/I:H/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Access of resource using incompatible type ('type confusion') in Windows OLE allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Windows OLE (Object Linking and Embedding) allows an unauthorized network attacker to run arbitrary code by triggering a type-confusion condition (CWE-843) in the OLE component. The flaw affects a broad range of client and server SKUs from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through Server 2025, and carries a CVSS 8.1 (High) rating. No privileges or authentication are required per the CVSS vector, though the high attack complexity (AC:H) means exploitation depends on winning a specific timing or memory-state condition; there is no public exploit identified at time of analysis and it is not on CISA KEV.
Technical ContextAI
OLE (Object Linking and Embedding) is a core Windows COM-based technology that lets applications embed and link objects (documents, images, structured storage) across processes and file formats; it underpins compound documents, drag-and-drop, and clipboard object transfer used throughout Office, Explorer, and countless third-party apps. The root cause is CWE-843, access of a resource using an incompatible type ('type confusion'): OLE interprets a memory object as one type when it is actually another, so operations valid for the assumed type corrupt memory when applied to the real object. This typically arises when a maliciously crafted OLE object or structured-storage stream declares or is coerced into a type that OLE's marshalling/deserialization logic mishandles, allowing an attacker to control a pointer or vtable and redirect execution. The affected CPE set spans the Windows OLE stack shipped in Windows 10/11 and Windows Server 2012 R2 through 2025.
RemediationAI
Apply the Microsoft security update for CVE-2026-50686 for your specific Windows/Windows Server build; the input confirms a vendor-released patch is available, so treat the monthly cumulative/security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50686 as the primary and authoritative fix (exact fixed build numbers are listed there and were not provided in this input, so do not assume a version). Because OLE is exploited via crafted content, interim compensating controls until patching include blocking or stripping risky attachments and embedded-object file types at the mail gateway and web proxy, enabling Office Protected View and disabling automatic OLE object activation / packager objects via Group Policy (trade-off: may break legitimate embedded-document workflows), and using attack-surface-reduction rules plus network segmentation to limit exposure of unpatched servers. These mitigations reduce but do not eliminate risk and can disrupt document interoperability, so patching remains the only complete remedy.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today