CVE-2026-50670 is a Windows Win32k elevation of privilege vulnerability caused by an out-of-bounds read. Microsoft rates it as High severity with a CVSS v3.1 base score of 8.8 and temporal score of 7.7. The vector is local attack only, with low attack complexity, low privileges required, no user interaction, and changed scope; the impact is high for confidentiality, integrity, and availability. Microsoft states there is no public disclosure and no known exploitation, and exploit code maturity is unproven. Because this is a local privilege escalation issue, enterprise risk is highest on systems where untrusted local code or users can run.

Highlights:
- CVSS scores: Base 8.8 - Temporal 7.7
- Exploit status & code maturity: Publicly Disclosed: No; Exploited: No; Exploit Code Maturity: UNPROVEN.
- Impact: Elevation of Privilege; confidentiality, integrity, and availability impacts are all HIGH. Microsoft’s FAQ says a successful attacker could gain SYSTEM privileges.
- Exploitation likelihood: Exploitation Less Likely; local vector, LOW attack complexity, LOW privileges required, and NO user interaction.
- Severity for enterprise: High technical severity, but the local-only attack vector lowers exposure for internet-facing services. Risk is more relevant on endpoints, servers, or multi-user systems where a low-privileged attacker could obtain local execution.
- Patch status: available; customer action is required.

Affected systems:
- Windows 10 1809
- Windows 10 21H2
- Windows 10 22H2
- Windows 11 24H2
- Windows 11 25H2
- Windows 11 26H1
- Windows 11 unspecified
- Windows Server 2019
- Windows Server 2022
- Windows Server 2025