What is the CVSS score of EUVD-2026-43844?

EUVD-2026-43844 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for EUVD-2026-43844?

Yes, a patch is available for EUVD-2026-43844. Update the affected software to the latest version immediately.

Windows CimFS Driver EUVD-2026-43844

| CVE-2026-50381 MEDIUM

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-07-14 microsoft

GHSA-2vv6-fvmm-g8r3

Information Disclosure Memory Corruption Microsoft Windows Server 2022 Windows Server 2025 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation

5.5

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

Local kernel driver reachable with a standard user account; type confusion yields high confidentiality via memory read with no integrity or availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 17:33 vuln.today

CVE Published

Jul 14, 2026 - 17:06 nvd

MEDIUM 5.5

DescriptionCVE.org

Access of resource using incompatible type ('type confusion') in Composite Image File System Driver allows an authorized attacker to disclose information locally.

AnalysisAI

Type confusion in the Windows Composite Image File System (CimFS) kernel driver enables local, low-privileged authenticated users to disclose protected memory contents on widely-deployed Windows 10, Windows 11, and Windows Server platforms. The flaw (CWE-843) causes the driver to access a kernel resource via an incompatible type, resulting in unintended memory reads with high confidentiality impact. No public exploit or active exploitation has been confirmed - SSVC lists exploitation as 'none,' EPSS stands at 0.29% (21st percentile), and the vulnerability is absent from the CISA KEV catalog - placing real-world risk in the lower-medium tier despite the C:H CVSS sub-score.

Technical ContextAI

CimFS (Composite Image File System) is a Windows kernel-mode driver (cimfs.sys) introduced for Windows container image layer management, present by default on Windows 10, Windows 11, and Windows Server 2022/2025. CWE-843 (Type Confusion) occurs when the driver incorrectly interprets the type of a resource it accesses - for example, treating a memory object as a different structure type than it actually is - causing the kernel to follow a pointer or dereference memory relative to the wrong layout. This class of bug routinely enables out-of-bounds reads within the kernel address space. The affected CPE strings span cpe:2.3:a:microsoft:windows_10_version_21h2, windows_10_version_22h2, windows_11_version_24h2, windows_11_version_25h2, windows_11_version_26h1, windows_server_2022, and windows_server_2025, confirming this is a driver-level flaw across Microsoft's current mainstream release surface rather than an isolated edition-specific issue.

RemediationAI

Apply the Microsoft security update available via Windows Update, WSUS, or the Microsoft Update Catalog, referencing the official advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50381. The vendor-confirmed fixed builds are: Windows 10 21H2 → 10.0.19044.7548; Windows 10 22H2 → 10.0.19045.7548; Windows 11 24H2 → 10.0.26100.8875; Windows 11 25H2 → 10.0.26200.8875; Windows 11 26H1 → 10.0.28000.2269; Windows Server 2022 → 10.0.20348.5386; Windows Server 2025 and Server Core → 10.0.26100.33158. No vendor-documented workaround is available, and disabling CimFS systemwide would break Windows container functionality - organizations relying on containers should treat patching as the only viable remediation path. Given the local-only vector, prioritize systems where untrusted or shared-access users operate (VDI, RDS, Kubernetes nodes) before single-user workstations.