EUVD-2026-44147
GHSA-5rp5-wgw3-6gwg
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local attack vector and PR:L because the description explicitly requires an authorized local attacker; C:H for potentially sensitive uninitialized memory contents; no integrity or availability impact applies.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally.
AnalysisAI
Uninitialized memory disclosure in the Windows SMB stack allows a locally authenticated attacker to read sensitive contents from uninitialized buffers, affecting Windows 10, Windows 11, and Windows Server 2012 through 2025. The flaw (CWE-908) resides in the SMB subsystem where a resource is consumed before being properly zeroed, leaking residual memory contents to a low-privileged local user. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog; SSVC assessment places exploitation at none with partial technical impact, making this a standard patch-cycle priority rather than an emergency response item.
Technical ContextAI
CWE-908 (Use of Uninitialized Resource) occurs when allocated memory or a resource is read or returned to a caller before being initialized, exposing whatever residual data occupied that memory region. In the Windows SMB (Server Message Block) protocol implementation, a specific code path allocates a buffer or internal resource and processes or returns it without a prior zeroing or initialization step, allowing the caller to observe stale memory contents. SMB is a core Windows component enabled by default on all affected versions, used for file sharing, named pipes, and inter-process communication. Per CPE data, the flaw is confirmed across Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 24H2, 25H2, and 26H1; and Windows Server 2012 through 2025 including Server Core variants.
RemediationAI
Apply the Microsoft-released security update via the advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50690, deployed through Windows Update, WSUS, Microsoft Update Catalog, or SCCM/Intune. The exact patched build numbers are not independently confirmed from the provided data beyond vendor acknowledgment that a patch is available - consult the MSRC advisory directly for specific KB article numbers and build versions. For environments where immediate patching is not feasible, restrict local interactive and remote desktop logon rights on SMB-hosting systems to the minimum necessary user set, reducing the pool of accounts that could trigger the uninitialized read. Disabling SMB entirely is not recommended as a compensating control given SMB's broad operational role and the local-only attack surface of this flaw - the access restriction approach achieves meaningful risk reduction with manageable operational trade-offs.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-908 – Use of Uninitialized Resource
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today