EUVD-2026-43977
GHSA-44xc-xw9f-mjr5
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Local authenticated access with no user interaction gives AV:L/AC:L/PR:L/UI:N; description is disclosure-only, so C:H with I:N and A:N, diverging from the input's I:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use of uninitialized resource in Microsoft Windows App Store allows an authorized attacker to disclose information locally.
AnalysisAI
Local information disclosure in the Microsoft Windows App Store (Store/AppX component) affects a broad range of Windows 10, Windows 11, and Windows Server releases (1607 through 26H1, Server 2016/2019/2022/2025). An authorized local attacker can leverage a use of uninitialized resource (CWE-908) to read memory contents that should not be exposed, with CVSS 7.1 reflecting high confidentiality impact but requiring low-privileged authenticated local access. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and Microsoft has released a patch via the MSRC update guide.
Technical ContextAI
The affected component is the Windows App Store / Microsoft Store client stack (AppX/Store servicing) that ships as an inbox component across the Windows product family. The root cause is CWE-908 (Use of Uninitialized Resource): a memory buffer, structure, or object is used before being fully initialized, so residual data left in that memory region - potentially from prior operations or other processes - can be read back by the attacker. The CPE set confirms this is not a standalone third-party application but OS-integrated Store functionality present on client SKUs (Windows 10 1607/1809/21H2/22H2, Windows 11 24H2/25H2/26H1) and server SKUs (Windows Server 2016/2019/2022/2025, including Server Core installations), meaning the vulnerable code path is widely present even on servers where the Store is rarely used interactively.
RemediationAI
Apply the Microsoft security update for CVE-2026-49165 as documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49165 - Patch available per vendor advisory; the exact fixed KB/build numbers are enumerated per Windows release in that advisory and should be sourced there rather than assumed, since fixes are delivered as cumulative monthly updates. Deploy the relevant cumulative update to all affected client and server SKUs, prioritizing multi-user and shared systems where untrusted local accounts exist. As an interim compensating control on servers that do not need the Store, restrict interactive local logon to trusted administrators and consider disabling the Microsoft Store via Group Policy (Computer Configuration > Administrative Templates > Windows Components > Store > Turn off the Store application), accepting the trade-off that this blocks legitimate Store-based app installs and updates; this only reduces the interactive attack surface and is not a substitute for the patch.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-908 – Use of Uninitialized Resource
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today