EUVD-2026-44092
GHSA-276x-mfrj-hmjg
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local attack requiring standard user credentials; confidentiality impact is high while integrity and availability are unaffected, consistent with a read-only information disclosure flaw.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Exposure of sensitive information to an unauthorized actor in Microsoft Graphics Component allows an authorized attacker to disclose information locally.
AnalysisAI
Microsoft Graphics Component on Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025 leaks sensitive information to locally authenticated standard users. Exploitation requires existing local access with at least user-level privileges (PR:L, AV:L), after which the attacker can extract sensitive data through the Graphics Component without any user interaction. No active exploitation has been confirmed - SSVC categorizes exploitation as 'none,' CISA KEV listing is absent, and EPSS of 0.35% (27th percentile) reflects low near-term exploitation probability.
Technical ContextAI
The Microsoft Graphics Component is a core Windows subsystem responsible for graphics rendering, display management, and handling of graphical data structures such as device contexts, bitmaps, and graphics driver interfaces. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) identifies the root cause class as a failure to enforce access controls on sensitive data - in this context, likely memory contents, kernel-resident graphics structures, or driver-level data accessible through a user-mode API or system call surface. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U) is consistent with a vulnerability in a Graphics Component driver or Win32 subsystem call that does not adequately sanitize or restrict data returned to user-space callers. Affected CPEs confirm scope to Windows 11 builds on the 26100.x and 28000.x kernel lines, and Windows Server 2025 on the same 26100.x line.
RemediationAI
Apply the Microsoft security update documented in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50483. The confirmed fixed builds per ENISA EUVD-2026-44092 are: Windows 11 24H2 - update to build 10.0.26100.8875 or later; Windows 11 25H2 - update to build 10.0.26200.8875 or later; Windows 11 26H1 - update to build 10.0.28000.2269 or later; Windows Server 2025 and Server Core - update to build 10.0.26100.33158 or later. Where immediate patching is not feasible, enforce strict least-privilege access controls to limit which users have interactive or remote-desktop access to affected systems, reducing the population of users who could trigger the disclosure; note this does not eliminate the underlying flaw. Prioritize patching on multi-user systems, RDS servers, and Windows Server 2025 environments where untrusted or semi-trusted local sessions are common.
More in Windows Server 2025
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today