EUVD-2026-43846
GHSA-4gjp-9g3v-jfmp
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local-only attack requiring a low-privilege account; confidentiality impact only as key material is read but not modified or destroyed, with no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use of a cryptographic primitive with a risky implementation in Windows Key Guard allows an authorized attacker to bypass a security feature locally.
AnalysisAI
Windows Key Guard on multiple Windows 10, Windows 11, and Windows Server editions exposes a cryptographic security bypass to locally authenticated low-privilege users due to CWE-1240 (Use of a Cryptographic Primitive with a Risky Implementation), allowing protected key material to be accessed in violation of the Key Guard security boundary. Affected builds span Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025, representing a broad swath of Microsoft's current supported OS surface. No public exploit identified at time of analysis; EPSS sits at 0.21% (11th percentile) and SSVC classifies exploitation status as none with no automation potential, indicating low near-term exploitation probability despite the ubiquitous footprint.
Technical ContextAI
Windows Key Guard is a Microsoft security feature designed to isolate and protect cryptographic key material from unauthorized access, functioning as a boundary between user-mode processes and protected key stores. CWE-1240 (Use of a Cryptographic Primitive with a Risky Implementation) indicates the root cause is not an algorithmic flaw per se but a dangerous or deprecated usage of a cryptographic construct - for example, reliance on a weak key wrapping scheme, insecure key derivation function, or use of a primitive in a mode that undermines its security guarantees. The CPE strings confirm affected components span cpe:2.3:a:microsoft:windows_10_version_1809 through cpe:2.3:a:microsoft:windows_server_2025 across both desktop and server product lines. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N confirms the exploit path is local with low privilege entry, no user interaction, and a High confidentiality impact confined to the vulnerable system - consistent with key material exfiltration rather than arbitrary code execution.
RemediationAI
Apply the Microsoft-issued security update for CVE-2026-50303 via Windows Update or through the Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50303. Patched build thresholds confirmed via EUVD-2026-43846 are: Windows 10 1809 and Windows Server 2019 to build 10.0.17763.9020 or later; Windows 10 21H2 to 10.0.19044.7548 or later; Windows 10 22H2 to 10.0.19045.7548 or later; Windows Server 2022 to 10.0.20348.5386 or later; Windows 11 24H2 to 10.0.26100.8875 or later; Windows Server 2025 to 10.0.26100.33158 or later; Windows 11 25H2 to 10.0.26200.8875 or later; Windows 11 26H1 to 10.0.28000.2269 or later. Where patching is not immediately feasible, restrict interactive local logon rights on sensitive systems to the minimum necessary set of accounts using Group Policy (deny logon locally for non-essential users), and monitor key store access via Windows Security auditing events - note that these controls reduce exposure but do not eliminate the underlying cryptographic weakness and must not substitute for the vendor patch.
More in Windows Server 2019
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today