EUVD-2026-44243
GHSA-gff2-7gmp-8j5f
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local access and a low-privilege user account are required; only confidentiality is impacted with no integrity or availability effect, no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an authorized attacker to disclose information locally.
AnalysisAI
Windows Win32K information disclosure on multiple Windows 10, Windows 11, and Windows Server releases allows a locally authenticated low-privilege user to read sensitive kernel-level data that should be inaccessible to user-space processes. Rooted in CWE-200 (improper exposure of sensitive information), the flaw exposes confidentiality-impacting data via the Win32K graphical subsystem without requiring elevated rights or user interaction from another party. No public exploit code has been identified, CISA SSVC rates exploitation status as 'none,' and the EPSS score of 0.47% (38th percentile) confirms low near-term exploitation probability.
Technical ContextAI
Win32K (win32k.sys) is a Windows kernel-mode component implementing the core graphical subsystem - managing window management, menus, and the USER/GDI interfaces exposed to user-mode applications through system calls. CWE-200 indicates the kernel subsystem fails to properly restrict what memory contents or object data are returned when a low-privilege caller invokes a Win32K interface, resulting in sensitive kernel information leaking to user space. The CVSS vector AV:L/AC:L/PR:L confirms that any standard authenticated user with local access can trigger the disclosure without special configuration. Affected CPEs span Windows 10 21H2 and 22H2, Windows 11 24H2, 25H2, and 26H1, Windows Server 2022, and Windows Server 2025 including the Server Core installation.
RemediationAI
Apply the Microsoft security update for CVE-2026-56184 via Windows Update or the Microsoft Update Catalog as documented in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56184. The confirmed fixed builds are: Windows 10 21H2 at 10.0.19044.7548 or later, Windows 10 22H2 at 10.0.19045.7548 or later, Windows 11 24H2 at 10.0.26100.8875 or later, Windows 11 25H2 at 10.0.26200.8875 or later, Windows 11 26H1 at 10.0.28000.2525 or later, Windows Server 2022 at 10.0.20348.5386 or later, and Windows Server 2025 (including Server Core) at 10.0.26100.33158 or later. If immediate patching is not feasible, restrict interactive and remote shell access to affected systems for untrusted or low-privilege users - note that this reduces operational accessibility and may not be practical in multi-user environments such as RDS or VDI deployments. No additional workarounds are documented in available source data.
More in Windows 10 Version 21H2
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker corrupt kernel memory via a use-
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Local privilege escalation in the Microsoft Windows Kernel allows an already-authenticated attacker to elevate to SYSTEM
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today