EUVD-2026-43773
GHSA-c7pw-g42v-c482
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local access and standard user privilege required (AV:L/PR:L); read-only kernel memory disclosure yields C:H with no integrity or availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Windows Kernel allows an authorized attacker to bypass a security feature locally.
AnalysisAI
Out-of-bounds read in the Windows Kernel (CWE-125) enables a locally authenticated attacker with standard user privileges to bypass a kernel security feature and read kernel memory contents. Confirmed by Microsoft (MSRC) across Windows 10, Windows 11, and Windows Server 2012 through 2025 editions, with patches available for all affected builds. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS at 0.29% (20th percentile) and SSVC exploitation status of 'none' together signal low current exploitation activity, though the kernel memory disclosure primitive is a classic KASLR-defeat building block in chained exploits.
Technical ContextAI
The vulnerability resides in the Windows NT Kernel component, as identified by CPE strings covering Microsoft Windows desktop and server platforms from Windows 10 Version 1607 through Windows 11 Version 26H1 and Windows Server 2012 through 2025. CWE-125 (Out-of-Bounds Read) indicates the kernel reads beyond the bounds of an allocated buffer - a pattern typically arising in syscall handlers, driver ioctl interfaces, or memory management routines where length or offset validation is insufficient. The CVSS metrics C:H/I:N/A:N precisely characterize this as an information-disclosure primitive: the attacker can read but not write kernel memory, so the direct impact is data exposure rather than code execution. Scope:Unchanged (S:U) confirms the impact is bounded within the kernel's own security context. In practice, an exploitable kernel out-of-bounds read of this class is frequently used to leak kernel base addresses or sensitive data structures, defeating Kernel Address Space Layout Randomization (KASLR) as a prerequisite step in a multi-stage privilege-escalation chain.
RemediationAI
Apply Microsoft's security update via Windows Update, WSUS, or Microsoft Update Catalog targeting the fix builds confirmed by EUVD data: Windows 10 21H2 to 10.0.19044.7548, Windows 10 22H2 to 10.0.19045.7548, Windows 11 24H2 and 25H2 to 10.0.26100.8875, Windows 11 26H1 to 10.0.28000.2525, Windows Server 2016 and Windows 10 1607 to 10.0.14393.9339, Windows Server 2019 and Windows 10 1809 to 10.0.17763.9020, Windows Server 2022 to 10.0.20348.5386, Windows Server 2025 and Server Core to 10.0.26100.33158, Windows Server 2012 and Server Core to 6.2.9200.26226, and Windows Server 2012 R2 and Server Core to 6.3.9600.23291. The full patch guidance is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58614. Where patching must be delayed, restrict local interactive logon and Remote Desktop access to only managed, trusted user accounts via Group Policy (Deny log on locally / Deny log on through Remote Desktop Services) - this reduces the attacker pool to known-good personnel but does not eliminate risk from compromised legitimate accounts. Note that Windows Server 2012 and 2012 R2 are past end of Extended Security Update eligibility for most customers; organizations still running these should treat patching as urgent and plan migration.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today