Use of uninitialized resource in Microsoft Windows and Windows Server - CVE-2026-96022

Vulnerability details

The vulnerability allows a local user to disclose potentially sensitive information from heap memory.

The vulnerability exists due to use of an uninitialized resource in Windows Text Services Framework when resources are accessed before initialization. A local user can exploit this condition locally to read small portions of heap memory.

Successful exploitation depends on previously used memory in the affected process remaining readable, so information disclosure may be unreliable.

Affected software

How to mitigate CVE-2026-96022

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96022
• https://support.microsoft.com/help/5131085

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Windows