CVE-2026-50377

What it actually does

This vulnerability is an out-of-bounds read in the Windows Kernel reachable by a local, authenticated attacker. By invoking the vulnerable kernel code path with crafted inputs, an attacker may cause the kernel to read memory outside the intended bounds, potentially disclosing sensitive kernel memory such as addresses, object metadata, tokens, or other privileged state. Although the CVSS vector emphasizes confidentiality impact, the vulnerability is classified as local privilege escalation because leaked kernel information can help an attacker bypass kernel exploit mitigations or complete a chain that results in higher privileges on the affected Windows system.

Why it matters to the business

Successful exploitation can allow a user or malware that already has limited access to a Windows workstation or server to gain greater control over that system. This can enable credential theft, security tool tampering, lateral movement, persistence, and broader compromise of business-critical systems. The issue affects multiple supported Windows client and server versions, including Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025, so exposure may be widespread in mixed enterprise fleets. It is not currently listed in CISA KEV, is not reported as ransomware-used, and has no known public exploit maturity in the supplied data, but local privilege escalation flaws are commonly valuable after phishing, malware execution, stolen credentials, or exploitation of another initial-access vulnerability.

How an attack unfolds

An attacker must first obtain local, authenticated execution on an affected Windows system, such as through a compromised user account, malware dropper, remote access tool, or another vulnerability that provides code execution. The attacker then runs a crafted local program that interacts with the vulnerable Windows Kernel code path and supplies malformed parameters that trigger an out-of-bounds read. The resulting memory disclosure may reveal kernel addresses or sensitive kernel structures that weaken platform defenses such as address randomization. The attacker can then use the disclosed information to support a privilege-escalation chain, potentially moving from a standard user context to an administrator or SYSTEM-level context. After elevating privileges, the attacker may dump credentials, disable defenses, install persistence, access protected data, or move laterally to other systems.

How to fix it

Apply the Microsoft security update that remediates CVE-2026-50377 for all affected Windows versions through Windows Update, Microsoft Update Catalog, WSUS, Intune, Configuration Manager, or the organization’s standard patch-management platform. Because exact KB or build-level fixed versions were not provided in the input, validate against Microsoft’s official security update guidance for the affected products: Windows 10 1607, 1809, 21H2, and 22H2; Windows 11 24H2, 25H2, and 26H1; Windows Server 2016, 2019, 2022, and 2025. Prioritize systems where untrusted users can log on, shared workstations, VDI, jump servers, developer workstations, domain administration workstations, and internet-facing servers where another vulnerability could provide initial code execution. If immediate patching is not possible, reduce risk by restricting interactive logon rights, removing unnecessary local administrator memberships, enforcing least privilege, enabling tamper protection and credential protections, monitoring for suspicious local privilege escalation behavior, and limiting the ability to execute unsigned or untrusted binaries from user-writable paths.

How to confirm the fix worked

Confirm that each affected system has installed the Microsoft cumulative or security update that includes the fix for this vulnerability. Use enterprise patch tooling, Windows Update history, PowerShell inventory, vulnerability scanners, or Microsoft Defender Vulnerability Management to verify compliance. Validate OS build numbers and installed KBs against Microsoft’s official release notes for the July 2026 or later security update train applicable to each Windows version. Re-scan endpoints after patch deployment to ensure the vulnerability is no longer reported. Where possible, confirm that systems have rebooted after patching, since Windows kernel fixes generally require a reboot to take effect. For compensating controls, verify that standard users cannot interactively log on to sensitive servers unless required and that endpoint telemetry captures process creation, privilege assignment, and suspicious execution from user-writable directories.

Typical attack path

1. Gain local authenticated access to an affected Windows client or server.
2. Stage or execute a purpose-built local exploit binary under the compromised user context.
3. Trigger the vulnerable Windows Kernel code path using crafted inputs that cause an out-of-bounds memory read.
4. Use disclosed kernel memory information to bypass mitigations or support a privilege-escalation chain.
5. Obtain elevated local privileges, potentially including administrator or SYSTEM-level execution.
6. Use elevated access to disable security controls, collect credentials, establish persistence, or move laterally.

How to detect it

There are no unique public exploit indicators provided for this vulnerability, and local Windows kernel exploitation may leave limited direct evidence. Detection should focus on behavior before and after attempted privilege escalation. Review Windows Security logs, Sysmon or EDR telemetry, PowerShell logs, Windows Error Reporting, and System event logs for suspicious local execution followed by elevated privileges. Look for low-privileged user processes spawning unexpected administrative or SYSTEM-level processes, unusual process execution from user-writable locations, sudden assignment of powerful privileges, attempts to access LSASS or credential material, new services or scheduled tasks created shortly after suspicious execution, security tool tampering, and unexpected kernel crashes or bugchecks. Useful Windows event sources include Security Event ID 4688 for process creation, 4672 for special privileges assigned, 4624 for logons, 4697 for service installation, 4698 for scheduled task creation, 7045 in the System log for new service installation, Sysmon Event ID 1 for process creation, Sysmon Event ID 10 for process access, and Windows Error Reporting or BugCheck events that may indicate unstable exploit attempts. Correlate these events by user, host, time window, parent-child process relationships, integrity level, and execution path.

• Event ID 4672
• Special privileges assigned to new logon
• SeDebugPrivilege
• SeImpersonatePrivilege
• SeAssignPrimaryTokenPrivilege
• Event ID 4688
• Event ID 4697
• Event ID 4698
• Event ID 7045
• Sysmon Event ID 1
• Sysmon Event ID 10
• \AppData\Local\Temp\
• \Windows\Temp\
• \Users\Public\
• \Downloads\
• powershell.exe -ExecutionPolicy Bypass
• cmd.exe /c whoami /priv
• whoami /groups
• vssadmin.exe Delete Shadows
• sc.exe create
• schtasks.exe /Create
• rundll32.exe
• regsvr32.exe
• lsass.exe
• MiniDump
• comsvcs.dll
• BugCheck
• LiveKernelEvent
• Microsoft-Windows-WER-SystemErrorReporting

What your security team should do

• Prioritize patch deployment to high-value Windows servers, administrator workstations, jump hosts, shared systems, and endpoints with broad user access.
• Verify whether the vulnerability is present across all affected Windows versions in the estate, including older Windows 10 and Windows Server releases that may be missed by standard patch rings.
• Require post-patch reboot validation because kernel updates are not fully effective until the updated kernel components are loaded.
• Hunt for signs of local privilege escalation activity around the publication date and onward, especially suspicious processes launched from user-writable paths followed by elevated privilege events.
• Review endpoint detections for unusual child processes, unsigned binaries, driver-loading attempts, credential dumping, security-tool tampering, and rapid privilege changes.
• Restrict local logon and remote interactive logon rights on servers to only required administrators and managed service accounts.
• Enforce application control or attack surface reduction rules to reduce execution of untrusted binaries from temporary, downloads, and profile directories.
• Monitor for exploit development even though the supplied data indicates no known public exploit maturity and no current KEV listing.