Main Vulnerability Database Vulnerabilities #VU138019

Information disclosure in Microsoft Windows and Windows Server - CVE-2026-50416

Published: July 17, 2026 / Updated: August 14, 2026

Vulnerability identifier: #VU138019

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-50416

CWE-ID: CWE-200

Exploitation vector: Local access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to exposure of sensitive information in Win32K when handling local operations. A local user can exploit the issue to disclose sensitive information.

An attacker who successfully exploits this vulnerability could read small portions of heap memory.

Affected software

Microsoft Windows
Windows Server

How to mitigate CVE-2026-50416

Install security update from vendor's website.

Microsoft Windows - addressed in versions 11 24H2 10.0.26100.8875, 11 25H2 10.0.26200.8875, 11 26H1 10.0.28000.2525
Windows Server - addressed in versions 2012 R2 6.3.9600.23291, 2025 10.0.26100.33158

Links to Public Exploits and PoC-codes

Exploit #12915 - Menagerie (A collection of public Windows CVE exploits and PoCs.) (August 14, 2026)

External References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-50416

Related Security Bulletins

Multiple vulnerabilities in Microsoft Windows