EUVD-2026-44062
GHSA-2h9c-p959-263w
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authenticated low-privilege user (AV:L/PR:L) triggers the flaw with low complexity and no user interaction, yielding full escalation impact (C:H/I:H/A:H); scope unchanged as it stays within the OS.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Microsoft Windows Kernel allows an authenticated low-privileged user to elevate to higher (likely SYSTEM-level) privileges by triggering an out-of-bounds read condition. The flaw affects a broad range of currently supported Windows client and server builds, from Windows 10 21H2 through Windows 11 26H1 and Windows Server 2022/2025. Microsoft has released a patch; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
The vulnerability resides in the Windows Kernel (the core ntoskrnl execution layer that mediates all privileged operations, memory management, and syscall handling), making it a highly sensitive component. The root cause is classified as CWE-125 (Out-of-bounds Read), where kernel code reads memory beyond the bounds of an allocated buffer - typically due to missing or incorrect length/index validation on attacker-influenced input crossing the user-to-kernel boundary. Microsoft's own tags label this both 'Information Disclosure' and 'Buffer Overflow.' While an out-of-bounds read is classically an information-disclosure primitive (e.g., leaking kernel pointers to defeat KASLR), the assigned CVSS impact of C:H/I:H/A:H and the 'elevate privileges' description indicate the read primitive is leveraged as part of a broader exploitation path leading to full privilege escalation. The affected CPE set spans Windows 10 (21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2022 and 2025 including Server Core installations.
RemediationAI
Apply the Microsoft security update for CVE-2026-50399; patch is available per vendor advisory (exact fixed build number not provided in the input - obtain it from the MSRC entry at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50399 and deploy the corresponding cumulative update for each affected SKU: Windows 10 21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2022/2025 including Server Core). Because exploitation requires local authenticated access, compensating controls until patching completes include enforcing least-privilege so untrusted users cannot run arbitrary code, restricting interactive and remote-desktop logon rights on high-value servers, and prioritizing patch deployment on multi-user systems (RDS/Citrix hosts, jump boxes) where low-privilege users share a kernel - the trade-off is that tightening logon rights can disrupt legitimate shared-access workflows and does not eliminate the underlying flaw. There is no documented feature-level workaround for a kernel defect, so patching is the only true fix.
More in Windows Server 2022
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack co
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today