CVE-2026-50363

What it actually does

This vulnerability is a heap-based buffer overflow in the Windows Push Notifications component. A locally authenticated, low-privileged attacker can trigger memory corruption in the notification-handling code path and potentially execute code with elevated privileges. Because the CVSS vector is local, low complexity, requires prior authentication, and requires no user interaction, the flaw is most relevant after an attacker has already obtained a foothold on a Windows workstation or server. Successful exploitation can compromise confidentiality, integrity, and availability at the affected host level.

Why it matters to the business

If exploited, this flaw can allow an attacker who already has basic access to a Windows system to gain higher privileges, disable security controls, access sensitive data, install persistence, or move laterally. It affects multiple supported Windows client and server versions, including Windows 10, Windows 11, and Windows Server releases from 2012 through 2025, so exposure may be broad in mixed Windows estates. It is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, and has low EPSS at this time, but local privilege escalation flaws are commonly chained with phishing, credential theft, remote code execution, or initial-access malware.

How an attack unfolds

An attacker first needs valid local code execution as a standard user or another low-privileged principal on an affected Windows system. They then interact with the Windows Push Notifications service or associated notification APIs in a way that sends malformed data to the vulnerable component. The crafted input causes heap memory corruption. If the attacker controls the corrupted memory state reliably, they may redirect execution flow or otherwise influence privileged service behavior to run code with elevated permissions. After privilege escalation, the attacker can perform post-exploitation actions such as credential dumping, tampering with endpoint defenses, creating privileged accounts, installing persistence, accessing protected files, or using the host as a staging point for lateral movement. No public exploit maturity is reported in the provided data, so exploitation details and stable artifacts may vary.

How to fix it

Apply the Microsoft security update that remediates this vulnerability for all affected Windows versions, including Windows 10 1607, 1809, 21H2, 22H2; Windows 11 24H2, 25H2, 26H1; and Windows Server 2012, 2016, 2019, 2022, and 2025. No exact fixed build numbers were provided, so use Microsoft Update, Windows Update for Business, WSUS, Microsoft Configuration Manager, or the Microsoft Update Catalog to identify and deploy the applicable cumulative update for the affected OS release. Prioritize systems where untrusted users can log in interactively, shared workstations, VDI, jump hosts, developer endpoints, and servers that permit multiple local users. If immediate patching is not possible, reduce exposure by limiting local logon rights, removing unnecessary standard-user access, enforcing application control, restricting execution from user-writable directories, enabling tamper protection and credential protection features, and monitoring suspicious interactions with Windows notification services. Avoid disabling core Windows services unless validated for operational impact, because Windows Push Notifications may be used by legitimate OS and application features.

How to confirm the fix worked

Confirm that each affected Windows system has installed the relevant Microsoft cumulative security update released for this vulnerability. Validate through centralized patch-management reporting, Windows Update compliance, Microsoft Defender Vulnerability Management, or authenticated vulnerability scanning. On individual systems, review installed hotfixes and OS build information using supported administrative methods such as Windows Update history, Get-HotFix, winver, systeminfo, or enterprise inventory tools. Re-scan with an authenticated scanner after patching to verify the vulnerability is no longer detected. Also confirm that local privilege boundaries remain enforced by testing with a non-administrative account and verifying that notification-related services are not crash-looping or generating abnormal fault telemetry.

Typical attack path

1. Gain initial authenticated access to an affected Windows workstation or server as a low-privileged user.
2. Execute local tooling or malware on the host.
3. Invoke or interact with Windows Push Notifications functionality using specially crafted input.
4. Trigger the heap-based buffer overflow in the notification component.
5. Achieve code execution or security-context manipulation with elevated local privileges.
6. Use elevated privileges to disable defenses, access sensitive data, dump credentials, establish persistence, or move laterally.

How to detect it

To assess whether this was already exploited, focus on local post-exploitation evidence rather than a single definitive exploit signature. Review Windows Security logs for privilege changes, new local administrators, service creation, scheduled task creation, suspicious process launches, and credential-access activity after low-privileged user logons. Examine System and Application logs for crashes, heap corruption, or Windows Error Reporting events involving Windows Push Notifications components, notification-related svchost service groups, or unexpected service restarts. Review EDR telemetry for a standard-user process spawning elevated cmd.exe, powershell.exe, pwsh.exe, rundll32.exe, regsvr32.exe, wscript.exe, cscript.exe, mshta.exe, or service-control utilities. Look for abnormal access to LSASS, creation of persistence mechanisms, disabling of security tools, and lateral movement shortly after notification-service crashes. Relevant log sources include Windows Security, System, Application, Microsoft-Windows-PushNotifications-Platform/Operational, Microsoft-Windows-WER-SystemErrorReporting/Operational, Sysmon if deployed, PowerShell logs, Defender for Endpoint or other EDR telemetry, and vulnerability/patch-management records. Because no public exploit maturity or stable exploit artifact is reported, absence of the listed indicators does not prove non-exploitation.

• Microsoft-Windows-PushNotifications-Platform/Operational
• Microsoft-Windows-WER-SystemErrorReporting/Operational
• WpnService
• WpnUserService
• WpnUserService_
• svchost.exe -k UnistackSvcGroup
• Faulting application name: svchost.exe
• Faulting module name: Windows.UI.Notifications
• Exception code: 0xc0000374
• Exception code: 0xc0000005
• Event ID 7031
• Event ID 7034
• Event ID 4688
• Event ID 4672
• Event ID 4697
• Event ID 4720
• Event ID 4732
• Event ID 7045
• cmd.exe /c net localgroup administrators
• net localgroup administrators /add
• powershell.exe -ExecutionPolicy Bypass
• sc.exe create
• schtasks.exe /create
• wevtutil.exe cl
• reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

What your security team should do

• Prioritize patch deployment to Windows systems that allow interactive logon by non-administrators, shared-user systems, VDI pools, jump hosts, and high-value servers.
• Use authenticated vulnerability scanning or endpoint vulnerability management to identify all affected Windows 10, Windows 11, and Windows Server systems.
• Review local administrator group membership and remove unnecessary privileged access to reduce the impact of any local escalation attempt.
• Harden post-exploitation controls: enable Microsoft Defender Antivirus or equivalent EDR, tamper protection, attack surface reduction rules, LSASS credential protections, and application control where feasible.
• Monitor for unusual crashes or faulting events involving Windows Push Notifications services and svchost instances hosting notification-related services.
• Investigate recent suspicious local privilege escalation behavior, especially where a low-privileged process launches privileged shells, modifies services, creates users, disables security tools, or accesses credential material.
• Because there is no current KEV listing, no known ransomware association, low EPSS, and no reported exploit maturity, treat this as important patching rather than emergency internet-facing remediation, unless local threat exposure is high.