EUVD-2026-44243
GHSA-gff2-7gmp-8j5f
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local access and a low-privilege user account are required; only confidentiality is impacted with no integrity or availability effect, no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an authorized attacker to disclose information locally.
AnalysisAI
Windows Win32K information disclosure on multiple Windows 10, Windows 11, and Windows Server releases allows a locally authenticated low-privilege user to read sensitive kernel-level data that should be inaccessible to user-space processes. Rooted in CWE-200 (improper exposure of sensitive information), the flaw exposes confidentiality-impacting data via the Win32K graphical subsystem without requiring elevated rights or user interaction from another party. No public exploit code has been identified, CISA SSVC rates exploitation status as 'none,' and the EPSS score of 0.47% (38th percentile) confirms low near-term exploitation probability.
Technical ContextAI
Win32K (win32k.sys) is a Windows kernel-mode component implementing the core graphical subsystem - managing window management, menus, and the USER/GDI interfaces exposed to user-mode applications through system calls. CWE-200 indicates the kernel subsystem fails to properly restrict what memory contents or object data are returned when a low-privilege caller invokes a Win32K interface, resulting in sensitive kernel information leaking to user space. The CVSS vector AV:L/AC:L/PR:L confirms that any standard authenticated user with local access can trigger the disclosure without special configuration. Affected CPEs span Windows 10 21H2 and 22H2, Windows 11 24H2, 25H2, and 26H1, Windows Server 2022, and Windows Server 2025 including the Server Core installation.
RemediationAI
Apply the Microsoft security update for CVE-2026-56184 via Windows Update or the Microsoft Update Catalog as documented in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56184. The confirmed fixed builds are: Windows 10 21H2 at 10.0.19044.7548 or later, Windows 10 22H2 at 10.0.19045.7548 or later, Windows 11 24H2 at 10.0.26100.8875 or later, Windows 11 25H2 at 10.0.26200.8875 or later, Windows 11 26H1 at 10.0.28000.2525 or later, Windows Server 2022 at 10.0.20348.5386 or later, and Windows Server 2025 (including Server Core) at 10.0.26100.33158 or later. If immediate patching is not feasible, restrict interactive and remote shell access to affected systems for untrusted or low-privilege users - note that this reduces operational accessibility and may not be practical in multi-user environments such as RDS or VDI deployments. No additional workarounds are documented in available source data.
More in Windows Server 2022
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack co
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today