CVE-2026-50491

What it actually does

This is a local privilege-escalation vulnerability in the Windows Code Integrity component, ci.dll. An attacker who already has low-privileged local access can trigger an out-of-bounds read during Code Integrity processing. Because Code Integrity participates in trust decisions for code, drivers, and protected execution paths, successful exploitation could allow the attacker to bypass intended security checks and gain elevated privileges on the affected Windows system. The CVSS vector indicates local access is required, user interaction is not required, privileges are required, and exploitation complexity is high, but successful exploitation can affect confidentiality, integrity, and availability at a high level.

Why it matters to the business

If exploited, this vulnerability can turn an initial foothold on a Windows workstation or server into administrative or SYSTEM-level control. That can enable credential theft, security tool tampering, lateral movement, persistence, ransomware staging, or modification of sensitive data. The issue affects a broad range of Windows client and server releases, including Windows 10, Windows 11, Windows Server 2012, 2016, 2019, 2022, and 2025, so organizations with heterogeneous Windows fleets may have widespread exposure. It is not currently listed in CISA KEV and no exploit maturity is reported, which lowers immediate public-exploitation urgency, but privilege-escalation flaws are commonly chained with phishing, malware, remote access trojans, and edge-service compromises.

How an attack unfolds

An attacker first obtains local code execution as a standard user, for example through malware execution, stolen credentials, abuse of remote access, or exploitation of another vulnerability. The attacker then invokes a crafted local operation that causes Windows Code Integrity to process attacker-controlled or attacker-influenced data. Due to improper bounds checking, ci.dll reads memory outside the intended buffer. In a successful exploit chain, the attacker uses the resulting behavior to influence a security decision or execution path and elevate from a low-privileged context to a highly privileged context such as administrator or SYSTEM. After elevation, the attacker can disable defenses, dump credentials, install persistence, modify protected files, or move laterally. High attack complexity means exploitation may be unreliable or require precise system conditions, but it remains valuable as a post-compromise escalation primitive.

How to fix it

Apply the applicable Microsoft security updates for all affected Windows versions: Windows 10 1607, 1809, 21H2, and 22H2; Windows 11 24H2, 25H2, and 26H1; and Windows Server 2012, 2016, 2019, 2022, and 2025. Because no exact fixed build numbers were provided, use Microsoft Update, Windows Update for Business, WSUS, Microsoft Configuration Manager, or the Microsoft Update Catalog to deploy the latest cumulative security update available for each supported operating system branch. Reboot systems after patching where required so the updated ci.dll and kernel-related components are loaded. Prioritize systems where local compromise would have high impact, including domain-joined servers, management workstations, jump hosts, virtualization hosts, and endpoints used by privileged administrators. Where immediate patching is not possible, reduce risk by limiting local administrator rights, restricting interactive logon to servers, enforcing application control where feasible, blocking untrusted driver and binary execution, and ensuring EDR tamper protection is enabled.

How to confirm the fix worked

Confirm that affected systems have installed the relevant cumulative Windows security update released after the vulnerability publication date. Validate through enterprise patch-management compliance reports, Windows Update history, installed hotfix inventory, and vulnerability-scanner checks. On individual systems, confirm the OS build and update level with standard Windows inventory methods and verify that ci.dll has been replaced by a version shipped with the post-fix cumulative update. Ensure systems have been rebooted after update installation, because Code Integrity components may remain loaded until restart. Re-scan representative Windows 10, Windows 11, and Windows Server assets to confirm the vulnerability no longer appears. For compensating controls, validate that standard users cannot write to protected system locations, load unapproved drivers, or disable endpoint security controls.

Typical attack path

1. Gain low-privileged local access to an affected Windows endpoint or server.
2. Stage exploit code or a crafted local input designed to interact with Windows Code Integrity processing.
3. Trigger the vulnerable ci.dll code path without requiring user interaction.
4. Abuse the out-of-bounds read condition to manipulate or bypass intended Code Integrity behavior.
5. Obtain elevated privileges, commonly administrator or SYSTEM, if exploitation succeeds.
6. Use the elevated context to disable security controls, access credentials, establish persistence, or support lateral movement.

How to detect it

There are no publicly reported exploit indicators or known threat-actor campaigns for this vulnerability based on the supplied data, and exploitation of a local privilege-escalation flaw may not leave a unique artifact. Detection should focus on signs that a low-privileged process unexpectedly gained elevated rights or performed actions normally requiring administrator or SYSTEM privileges. Review Windows Security logs for unusual logon-to-privilege transitions, new service creation, scheduled task creation, security policy changes, and privilege-use events. Correlate Sysmon or EDR telemetry for suspicious process ancestry, especially user-writable-path executables spawning elevated shells, service-control utilities, credential-access tools, or security-control tampering commands. Review Code Integrity and driver-loading telemetry for unexpected unsigned, newly dropped, or unusual binaries and drivers around the time of suspected privilege escalation. Investigate systems where endpoint protection was disabled, audit policy was changed, event logs were cleared, or credential stores were accessed shortly after execution of an untrusted user-context process.

What your security team should do

• Deploy the latest cumulative Microsoft security updates for affected Windows client and server versions, prioritizing internet-facing servers, administrator workstations, domain infrastructure, and high-value servers.
• Use asset inventory to identify all Windows 10, Windows 11, and Windows Server systems on affected release branches and track patch completion through centralized compliance reporting.
• Treat this as a post-compromise escalation risk: investigate any endpoint where low-privileged malware or suspicious user-context execution is observed, even if administrative activity appears later in the timeline.
• Harden local privilege boundaries by removing unnecessary local administrator rights, restricting server logons, and enforcing least privilege for service accounts and operational users.
• Monitor for suspicious privilege-escalation behavior, including unexpected SYSTEM process creation, security control tampering, credential-dumping activity, and unusual driver or code-signing related events.
• Ensure EDR, antivirus, and Windows security telemetry are active and protected from tampering before and after patch deployment.
• If patching must be delayed, increase monitoring on unpatched systems and restrict their exposure to untrusted users, remote interactive access, and unmanaged software execution.