EUVD-2026-35731
GHSA-j627-g2r3-f2jq
Severity by source
Sources disagree (Medium–Critical)AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: microsoft
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
Use of uninitialized resource in Windows Push Notifications allows an authorized attacker to disclose information locally.
AnalysisAI
Windows Push Notifications on multiple Windows 10, Windows 11, and Windows Server versions exposes sensitive memory contents through an uninitialized resource condition, allowing a low-privileged local user to read high-confidentiality data without any user interaction. The CVSS vector (AV:L/PR:L) confirms this is strictly a local privilege issue - no remote attack path exists - limiting its practical blast radius to insider threats and post-compromise lateral reconnaissance. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected versions.
Technical ContextAI
Windows Push Notifications (WPN) is the OS-level notification delivery platform, handling push payloads for both system and third-party applications across Windows 10, 11, and Server editions. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) arising from use of an uninitialized resource - a code path within the WPN subsystem reads from a memory region or handle that has not been properly initialized before use. This class of bug commonly exposes stale heap, stack, or kernel object memory from adjacent allocations, which may contain sensitive artifacts such as session tokens, decrypted data, or address-space layout information. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N confirms the attack surface is local, requires no elevated privileges, operates at low complexity, and yields high-confidentiality impact with no integrity or availability consequence. Affected build ranges span Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025, per EUVD-2026-35731.
RemediationAI
The primary remediation is to apply the Microsoft-released patches for each affected Windows version as confirmed by EUVD-2026-35731 and the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42971. Specific target build versions are: Windows 10 1607 and Server 2016 to 10.0.14393.9234; Windows 10 1809, Server 2019 to 10.0.17763.8880; Windows 10 21H2 to 10.0.19044.7417; Windows 10 22H2 to 10.0.19045.7417; Windows 11 23H2 to 10.0.22631.7219; Windows 11 24H2 to 10.0.26100.8655; Windows 11 25H2 to 10.0.26200.8655; Windows 11 26H1 to 10.0.28000.2269; Server 2022 to 10.0.20348.5256; Server 2025 to 10.0.26100.32995 (verify against MSRC due to build number discrepancy noted below). As a compensating control where immediate patching is not feasible, restrict interactive and remote desktop logon rights to only trusted accounts on exposed Server systems via Group Policy (User Rights Assignment: 'Allow log on locally' and 'Allow log on through Remote Desktop Services'), which reduces the pool of principals able to exploit this locally. This control does not eliminate the vulnerability but raises the privilege bar for exploitation on multi-user server systems. No side effects are associated with the patch itself.
More in Windows 10 1607
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Windows Shell contains a protection mechanism failure (CVE-2026-21510, CVSS 8.8) that allows unauthenticated remote atta
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptograph
Desktop Window Manager (DWM) in Windows contains a type confusion vulnerability (CVE-2026-21519, CVSS 7.8) that enables
Windows Common Log File System Driver contains another use-after-free for local privilege escalation, the latest in a se
Windows Storage contains an elevation of privilege vulnerability through symlink following that allows authorized attack
Windows Ancillary Function Driver for WinSock contains a use-after-free enabling local privilege escalation through a nu
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today