CVE-2026-50372

What it actually does

CVE-2026-50372 is a local privilege escalation vulnerability caused by a buffer over-read in Windows Redirected Drive Buffering, a Windows component involved in handling redirected drive operations. An attacker who already has low-privileged local access can trigger improper memory handling in the affected component and potentially elevate privileges on the same system. Although the attack requires local access and high attack complexity, successful exploitation can compromise confidentiality, integrity, and availability at the operating-system level.

Why it matters to the business

An attacker who has already gained a foothold on an affected Windows workstation or server could use this flaw to gain higher privileges, disable defenses, access sensitive data, install persistence, or move laterally. The vulnerability affects many supported Windows client and server versions, including Windows 10, Windows 11, and Windows Server 2012 through 2025, so broad enterprise exposure is possible. Current public exploitation signals are low: EPSS is 0.00246, exploit maturity is listed as none, and it is not in CISA KEV or known ransomware use, but privilege escalation flaws remain important because they are commonly chained after phishing, credential theft, or remote code execution.

How an attack unfolds

An attacker first needs authenticated local code execution on a vulnerable Windows system, such as through a compromised user account, malicious script, dropped payload, or another vulnerability. The attacker then invokes crafted redirected drive or file-system-related operations that reach the vulnerable Redirected Drive Buffering code path. By triggering the buffer over-read under the right conditions, the attacker attempts to influence kernel or privileged process behavior and obtain elevated privileges. If successful, the attacker can execute follow-on actions as an administrator or SYSTEM-equivalent context, such as credential dumping, tampering with security tools, creating privileged accounts, installing services, or staging lateral movement.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-50372 on all affected Windows versions, including Windows 10 1607, 1809, 21H2, and 22H2; Windows 11 24H2, 25H2, and 26H1; and Windows Server 2012, 2016, 2019, 2022, and 2025. Because no package-specific fixed versions were provided, use Microsoft Update, WSUS, Microsoft Configuration Manager, Intune, or the Microsoft Update Catalog to deploy the relevant July 2026 or later cumulative security update for each operating-system release. If immediate patching is not possible, reduce exposure by limiting local interactive access, restricting RDP access, disabling unnecessary drive redirection where operationally feasible, enforcing least privilege, and ensuring endpoint protection and exploit protection controls are active. Prioritize servers, shared workstations, RDP-accessible systems, administrative jump hosts, and endpoints used by privileged users.

How to confirm the fix worked

Confirm that the applicable Microsoft cumulative security update released for this vulnerability, or a later superseding update, is installed on each affected host. Validate through Windows Update history, enterprise patch management compliance reports, PowerShell inventory, and build/KB baselines from Microsoft guidance. Review whether affected OS versions are still in support and receiving security updates. Where mitigations were used, verify that RDP drive redirection and unnecessary redirected drive functionality are disabled or restricted according to policy. For exposure validation, identify unpatched Windows 10, Windows 11, and Windows Server systems and prioritize those allowing local logon, RDP, shared workstation use, or broad user access.

Typical attack path

1. Gain low-privileged local access to an affected Windows workstation or server.
2. Execute a purpose-built local exploit or helper program on the host.
3. Trigger crafted redirected drive or file-system operations that reach the vulnerable Windows Redirected Drive Buffering code path.
4. Abuse the memory handling flaw to elevate privileges locally.
5. Use the elevated context to disable defenses, dump credentials, install persistence, or move laterally.

How to detect it

Because this is a local privilege escalation vulnerability and no public exploit indicators are provided, detection should focus on behavioral evidence of exploitation and post-exploitation activity rather than a single definitive signature. Review Windows Security logs for unusual privilege assignment, process creation, account changes, service installation, and scheduled task creation around the time a low-privileged user session became elevated. Useful sources include Windows Security events 4688, 4672, 4697, 4698, 4720, 4728, 4732, 7045 from the System log, PowerShell logs, Sysmon events 1, 6, 7, 10, 11, and 13, EDR telemetry, Windows Error Reporting, and crash or bugcheck artifacts involving the Redirected Drive Buffering subsystem. Look for a low-privileged process interacting with redirected or network drives shortly before spawning administrative shells, creating services, modifying local groups, dumping credentials, or disabling security tools. Pay special attention to unpatched systems where RDP drive redirection is enabled or where many users have interactive logon rights. Since there is no known KEV listing or named threat actor activity in the supplied data, treat findings as suspicious when they show a privilege escalation sequence rather than relying on fixed IOCs alone.

• rdbss.sys
• \SystemRoot\System32\drivers\rdbss.sys
• C:\Windows\System32\drivers\rdbss.sys
• Event ID 4672
• Event ID 4688
• Event ID 4697
• Event ID 4698
• Event ID 4720
• Event ID 4728
• Event ID 4732
• Event ID 7045
• Sysmon Event ID 1
• Sysmon Event ID 6
• Sysmon Event ID 7
• Sysmon Event ID 10
• Sysmon Event ID 11
• Sysmon Event ID 13
• SeDebugPrivilege
• SeImpersonatePrivilege
• net localgroup administrators
• sc.exe create
• schtasks.exe /create
• wevtutil cl
• vssadmin delete shadows
• C:\ProgramData\Microsoft\Windows\WER\ReportArchive
• C:\Windows\Minidump

What your security team should do

• Patch affected Windows client and server systems with the applicable Microsoft security update or later cumulative update.
• Prioritize remediation on RDP-accessible systems, servers, administrator workstations, jump hosts, and systems where many users can log on interactively.
• Hunt for recent low-privilege-to-admin privilege transitions, unexpected service creation, new local administrators, and security tool tampering on unpatched systems.
• Restrict local logon and RDP access to authorized users only, and disable drive redirection where it is not required.
• Monitor for public exploit development even though current EPSS is low, exploit maturity is none, and the vulnerability is not listed in CISA KEV.
• Ensure endpoint detection controls collect process creation, privilege assignment, driver load, service creation, and Windows Error Reporting events for affected Windows hosts.