EUVD-2026-43936
GHSA-r64q-4mrv-xx3v
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local attack vector and low-privilege requirement are independently consistent with the description; high confidentiality impact reflects cryptographic material exposure; no integrity or availability impact applies.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Exposure of sensitive information to an unauthorized actor in Windows Cryptographic Services allows an authorized attacker to disclose information locally.
AnalysisAI
Windows Cryptographic Services across all supported Microsoft Windows client and server editions exposes sensitive cryptographic material to locally authenticated low-privilege users through a CWE-200 information disclosure flaw. Spanning Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025, the vulnerability allows an attacker with a standard local account to read confidential data - likely cryptographic keys, certificates, or intermediate cryptographic state - without any user interaction. SSVC rates exploitation as none, EPSS at 0.47% (38th percentile) indicates low near-term exploitation probability, and no active exploitation has been confirmed by CISA KEV, positioning this as a routine patch-cycle priority rather than an emergency response.
Technical ContextAI
Windows Cryptographic Services encompasses the Cryptography Next Generation (CNG) subsystem, which provides key management, certificate operations, and algorithm implementations used broadly across Windows and by third-party applications. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) identifies the root cause as a failure to properly restrict access to sensitive cryptographic state when accessed by a low-privileged local process - typical manifestations include improper handle permissions, insufficient ACLs on memory-mapped regions, or unguarded CNG API calls that return data the caller should not be authorized to read. The CPE data confirms the flaw spans cpe:2.3:a:microsoft:windows_10_version_1607 through cpe:2.3:a:microsoft:windows_11_version_26h1 and cpe:2.3:a:microsoft:windows_server_2012 through Server 2025, indicating the vulnerable code path has persisted across more than a decade of Windows development and updates. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N is technically coherent with this description: local access only, no complexity barrier, one-directional confidentiality impact with no write or availability component.
RemediationAI
Apply Microsoft's security update for CVE-2026-50352 via Windows Update or the Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50352. Fixed builds confirmed by EUVD version data are: Windows 10 1607 and Server 2016 to build 10.0.14393.9339 or later; Windows 10 1809 and Server 2019 to build 10.0.17763.9020 or later; Windows 10 21H2 to build 10.0.19044.7548 or later; Windows 10 22H2 to build 10.0.19045.7548 or later; Windows 11 24H2 to build 10.0.26100.8875 or later; Windows 11 25H2 to build 10.0.26200.8875 or later; Windows 11 26H1 to build 10.0.28000.2269 or later; Windows Server 2012 to build 6.2.9200.26226 or later; Windows Server 2012 R2 to build 6.3.9600.23291 or later; Windows Server 2022 to build 10.0.20348.5386 or later; and Windows Server 2025 to build 10.0.26100.33158 or later. Where immediate patching is blocked, restrict interactive local logon rights on systems handling sensitive cryptographic material to the minimum necessary accounts - note this reduces the attacker pool but does not eliminate the vulnerability, and it may limit legitimate administrative workflows. Windows Server 2012 and 2012 R2 are past end of standard support; organizations still running these should apply the patch through Microsoft's Extended Security Update (ESU) program and treat migration as urgent.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today