What is the CVSS score of EUVD-2026-43836?

EUVD-2026-43836 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Windows Kernel are affected by EUVD-2026-43836?

A privilege escalation vulnerability in Windows Kernel (CVE-2026-50354) affects Windows 10, 11, and Server systems across your infrastructure; while no public exploit has been identified yet, the…. A patch is available.

How to fix or mitigate EUVD-2026-43836?

Within 24 hours, inventory all Windows 10 (versions 1607 through latest), Windows 11 (all versions through 26H1), and Windows Server (2016 through 2025) systems to determine organizational exposure. Within 7 days, prioritize patching critical systems including domain controllers, file servers, and security infrastructure with Microsoft's latest kernel patch for each Windows version. Within 30 days, complete patch deployment across all identified affected systems using your standard change management and patch deployment procedures.

Windows Kernel EUVD-2026-43836

| CVE-2026-50354 HIGH

Use After Free (CWE-416)

2026-07-14 microsoft

GHSA-h5jv-76rr-555v

Denial Of Service Use After Free Memory Corruption Microsoft Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation

7.1

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

7.1 HIGH

Local low-privileged attacker exploits a kernel use-after-free with no user interaction (AV:L/PR:L/AC:L/UI:N); high integrity and availability impact, no confidentiality or scope change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 18:20 vuln.today

CVE Published

Jul 14, 2026 - 17:06 nvd

HIGH 7.1

DescriptionCVE.org

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in the Windows Kernel lets an already-authenticated, low-privileged user corrupt kernel memory via a use-after-free (CWE-416) and gain higher privileges on the host. The flaw affects a broad range of currently-supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2016 through 2025); Microsoft has shipped a fix. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The vulnerable component is the Windows Kernel (ntoskrnl / kernel-mode subsystem), the most privileged code on the platform, running in ring 0. The root cause is CWE-416, a use-after-free: kernel code continues to reference an object after its backing memory has been freed, allowing an attacker who can control the reallocation of that freed memory to manipulate kernel data structures. Successful manipulation lets attacker-controlled data be treated as a valid kernel object, which is the classic primitive for kernel-mode privilege escalation. The CPE data enumerates affected products purely as Microsoft Windows editions (client 10/11 and Server 2016-2025), indicating a defect in shared kernel code common to all supported branches rather than an edition-specific feature.

RemediationAI

Apply the Microsoft security update that addresses CVE-2026-50354 for each affected Windows edition; Patch available per vendor advisory - the input confirms a patch is available but does not specify an exact KB or build number, so consult the Microsoft update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50354 for the correct cumulative update per OS version and install it through Windows Update or WSUS/SCCM. Because exploitation requires an existing local low-privileged foothold, effective compensating controls until patching completes are to enforce least privilege and restrict interactive/local logon rights to trusted users, limit code execution by standard users (application allow-listing such as WDAC/AppLocker), and monitor endpoints for unexpected kernel crashes or privilege changes; these reduce the pool of accounts that could stage the attack but do not remove the underlying flaw and may impose administrative overhead on legitimate software.