CVE-2026-50475

Think of the kernel as Windows’ control room memory. This bug can accidentally “peek past” the end of a memory area and reveal information that was not meant to be shown.
In real life, that means someone who already has access to log in on the machine could potentially steal sensitive data from memory.

This affects the Windows versions listed: Windows 10, Windows 11, and Windows Server (2012, 2012 R2, 2016, 2019, 2022, 2025).
It matters most to you if an attacker (or a malicious insider) can get authorized local access to a system—because the vulnerability is local and requires low levels of authorization.
Treat it as relevant only for machines where the attacker can reach the system locally (e.g., someone can log on or otherwise gain local authorized access); if nobody can get local access, risk is much lower.

Marked RED because it’s a kernel-level information disclosure flaw with a patch already available, and it can expose sensitive data to an authorized local user.
Even though it’s not described as requiring user interaction and no public exploit is confirmed here, the impact is potentially high because kernel memory can contain valuable secrets.

Confirm exposure

• Identify your exact OS edition and build number.
  • Windows 10/11: Settings → System → About; record Version and OS build.
  • Windows Server: Settings/Control Panel → System (or run winver) and record the build.
• Match your build against the fixed versions Microsoft lists for CVE-2026-50475.

Upgrade to the fixed builds

Update to the corresponding fixed version listed below:

• Windows 10
  • Fixed in 10.0.14393.9339
  • Fixed in 10.0.17763.9020
  • Fixed in 10.0.19044.7548
  • Fixed in 10.0.19045.7548
• Windows 11
  • Fixed in 10.0.26100.8875
  • Fixed in 10.0.26200.8875
  • Fixed in 10.0.28000.2269
• Windows Server 2012: fixed in 6.2.9200.26226
• Windows Server 2012 R2: fixed in 6.3.9600.23291
• Windows Server 2016: fixed in 10.0.14393.9339
• Windows Server 2019: fixed in 10.0.17763.9020
• Windows Server 2022: fixed in 10.0.20348.5386

What if you can’t patch right away

• Reduce who can obtain local authorized access:
  • Remove unnecessary local admin rights.
  • Disable/limit accounts that shouldn’t log on locally.
• Tighten physical and console access controls so fewer people can reach the machine.
• Watch for suspicious local logons and unexpected activity on affected hosts (since the flaw is local).

Where to track the official update

• Use Microsoft’s update guide for CVE-2026-50475: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50475

KEV / exploitation notes

• This CVE is not listed in the CISA KEV program in the provided findings.
• No clear dated real-world exploitation report and no public exploit code were found in the provided findings.

CVE-2026-50475 is a Windows kernel information disclosure issue caused by a buffer over-read (CWE-126). The mechanism is an out-of-bounds read that can disclose confidential data from memory to an authorized local attacker.

Attack prerequisites from the findings:

• Local access is required.
• Authentication required: low (i.e., the attacker must be authorized and have local access).
• No user interaction.

Exploit/exposure indicators from the findings:

• Not present in CISA KEV.
• No clear dated press exploitation claim.
• No public exploit code on record.

Patch availability:

• Microsoft provides fixed builds across the affected Windows 10/11 and multiple Windows Server releases (linked via the Microsoft update guide).

Meaning of KEV here:

• KEV listing would indicate known exploitation; since it’s not listed in the findings, there’s no confirmed KEV-backed exploitation evidence included in this dataset.