CVE-2026-50332 is a Windows Kernel heap-based buffer overflow that leads to Elevation of Privilege. Microsoft rates it CVSS v3.1 Base 7.8 (High) with a temporal score of 6.8; the vector is LOCAL, LOW attack complexity, LOW privileges required, no user interaction, and unchanged scope. Microsoft states an attacker who successfully exploits it could gain SYSTEM privileges. There is no public disclosure and no known exploitation, but Microsoft rates exploitation as more likely. Because the attack is local rather than network-based, the main enterprise risk is on systems where an attacker can obtain local code execution or access.

Highlights:
- CVSS scores: Base 7.8 - Temporal 6.8
- Exploit status & code maturity: Publicly Disclosed: No; Exploited: No; Exploit Code Maturity: UNPROVEN.
- Impact: Elevation of Privilege; confidentiality, integrity, and availability impacts are all HIGH. Successful exploitation could grant SYSTEM privileges.
- Exploitation likelihood: Exploitation More Likely; the vector is LOCAL, with LOW attack complexity, LOW privileges required, and no user interaction.
- Severity for enterprise: High severity, but local-only exposure lowers risk for internet-facing services. Risk is higher on endpoints or servers where untrusted local code, users, or lateral movement may provide an attack path.
- Patch status: available; customer action is required.

Affected systems:
- Windows 10 1607
- Windows 10 1809
- Windows 10 21H2
- Windows 10 22H2
- Windows 11 24H2
- Windows 11 25H2
- Windows 11 26H1
- Windows 11 unspecified
- Windows Server 2012
- Windows Server 2012 R2
- Windows Server 2016
- Windows Server 2019
- Windows Server 2022
- Windows Server 2025