CVE-2026-50416

LOW

Microsoft Windows Win32K - Local Information Disclosure

Title source: manual
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-50416. PoCs published by karollooool.

AI-analyzed exploit summary This repository provides a detailed proof-of-concept for CVE-2026-50416, a KASLR bypass vulnerability in Windows 11 (Insider Build 10.0.28020.2134) via a kernel address leak in the desktop heap. The exploit demonstrates reading a kernel pointer from user-mode without privileges, enabling reliable kernel exploitation.

Description

Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an authorized attacker to disclose information locally.

Exploits (1)

nomisec WORKING POC 1 stars
by karollooool · poc
https://github.com/karollooool/CVE-2026-50416-writeup-and-poc

This repository provides a detailed proof-of-concept for CVE-2026-50416, a KASLR bypass vulnerability in Windows 11 (Insider Build 10.0.28020.2134) via a kernel address leak in the desktop heap. The exploit demonstrates reading a kernel pointer from user-mode without privileges, enabling reliable kernel exploitation.

Classification
Working Poc 98%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: Windows 11 Insider Build 10.0.28020.2134 (win32kfull.sys)
No auth needed
Prerequisites: User-mode code execution (e.g., via a browser renderer bug) · Desktop heap association (automatic in most user processes)
mistral-large-3 · analyzed Jul 17, 2026 Full analysis →

References (1)

Core 1
Core References
Vendor Advisory vendor-advisory patch
Win32k Information Disclosure Vulnerability
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50416

Scores

CVSS v3 3.3
EPSS 0.0047
EPSS Percentile 38.5%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-200
Status published
Products (9)
Microsoft/Windows 11 Version 24H2 10.0.26100.0 - 10.0.26100.8875
Microsoft/Windows 11 Version 25H2 10.0.26200.0 - 10.0.26200.8875
Microsoft/Windows 11 version 26H1 10.0.28000.0 - 10.0.28000.2525
Microsoft/Windows Server 2025 10.0.26100.0 - 10.0.26100.33158
Microsoft/Windows Server 2025 (Server Core installation) 10.0.26100.0 - 10.0.26100.33158
microsoft/windows_11_24h2 < 10.0.26100.8875 (2 CPE variants)
microsoft/windows_11_25h2 < 10.0.26200.8875 (2 CPE variants)
microsoft/windows_11_26h1 < 10.0.28000.2525 (2 CPE variants)
microsoft/windows_server_2025 < 10.0.26100.33158
Published Jul 14, 2026
Tracked Since Jul 14, 2026