CVE-2026-50381

Composite Image File System driver (cimfs.sys) Information Disclosure Vulnerability

Published Jul 14, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

Access of resource using incompatible type ('type confusion') in Composite Image File System Driver allows an authorized attacker to disclose information locally.

Analysis

Technical impact

The vulnerability resides in the Composite Image File System driver (cimfs.sys) where a type‑confusion error (CWE‑843) can be triggered by a local user with sufficient privileges. The flaw allows the attacker to read data that the driver should not expose, resulting in accidental disclosure of sensitive information. No remote execution or denial of service capability is described, and the impact is confined to the local system and accounts that can access the driver.

Affected Systems

Microsoft Windows 10 Version 21H2, Windows 10 Version 22H2, Windows 11 Version 24H2, Windows 11 Version 25H2, Windows 11 Version 26H1, Windows Server 2022, Windows Server 2025, and the Windows Server 2025 Server Core installation are affected.

Risk and Exploitability

The CVSS score of 5.5 ranks the issue in the medium security range, while the EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog and requires local authorized access, making it a legitimate threat primarily for systems where local accounts can be compromised.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Microsoft

Windows 10 Version 21H2

affected

Version	Status	Constraints
`10.0.19044.0`	affected	< 10.0.19044.7548

Microsoft

Windows 10 Version 22H2

affected

Version	Status	Constraints
`10.0.19045.0`	affected	< 10.0.19045.7548

Microsoft

Windows 11 Version 24H2

affected

Version	Status	Constraints
`10.0.26100.0`	affected	< 10.0.26100.8875

Microsoft

Windows 11 Version 25H2

affected

Version	Status	Constraints
`10.0.26200.0`	affected	< 10.0.26200.8875

Microsoft

Windows 11 version 26H1

affected

Version	Status	Constraints
`10.0.28000.0`	affected	< 10.0.28000.2525

Microsoft

Windows Server 2022

affected

Version	Status	Constraints
`10.0.20348.0`	affected	< 10.0.20348.5386

Microsoft

Windows Server 2025

affected

Version	Status	Constraints
`10.0.26100.0`	affected	< 10.0.26100.33158

Microsoft

Windows Server 2025 (Server Core installation)

affected

Version	Status	Constraints
`10.0.26100.0`	affected	< 10.0.26100.33158

Configuration 1 [-]

OR	cpe:2.3:o:microsoft:windows_10_21h2:::::::arm64:*
	cpe:2.3:o:microsoft:windows_10_21h2:::::::x64:*
	cpe:2.3:o:microsoft:windows_10_21h2:::::::x86:*
	cpe:2.3:o:microsoft:windows_10_22h2:::::::arm64:*
	cpe:2.3:o:microsoft:windows_10_22h2:::::::x64:*
	cpe:2.3:o:microsoft:windows_10_22h2:::::::x86:*
	cpe:2.3:o:microsoft:windows_11_24h2:::::::arm64:*
	cpe:2.3:o:microsoft:windows_11_24h2:::::::x64:*
	cpe:2.3:o:microsoft:windows_11_25h2:::::::arm64:*
	cpe:2.3:o:microsoft:windows_11_25h2:::::::x64:*
	cpe:2.3:o:microsoft:windows_11_26h1:::::::x64:*
	cpe:2.3:o:microsoft:windows_11_26h1:::::::arm64:*
	cpe:2.3:o:microsoft:windows_server_2022::::::::
	cpe:2.3:o:microsoft:windows_server_2025::::::::

No data.

Vendor Product Versions

Microsoft

Windows 10 21h2

Version	Status	Scheme	Platform
`[10.0.19044.0,10.0.19044.7548)`	affected	generic	['32-bit_systems', 'arm64-based_systems', 'x64-based_systems']

Microsoft

Windows 10 22h2

Version	Status	Scheme	Platform
`[10.0.19045.0,10.0.19045.7548)`	affected	generic	['32-bit_systems', 'arm64-based_systems', 'x64-based_systems']

Microsoft

Windows 11 24h2

Version	Status	Scheme	Platform
`[10.0.26100.0,10.0.26100.8875)`	affected	generic	['arm64-based_systems', 'x64-based_systems']

Microsoft

Windows 11 25h2

Version	Status	Scheme	Platform
`[10.0.26200.0,10.0.26200.8875)`	affected	generic	['arm64-based_systems', 'x64-based_systems']

Microsoft

Windows 11 26h1

Version	Status	Scheme	Platform
`[10.0.28000.0,10.0.28000.2525)`	affected	generic	['arm64-based_systems', 'x64-based_systems']

Microsoft

Windows Server 2022

Version	Status	Scheme	Platform
`[10.0.20348.0,10.0.20348.5386)`	affected	generic	['x64-based_systems']

Microsoft

Windows Server 2025

Version	Status	Scheme	Platform
`[10.0.26100.0,10.0.26100.33158)`	affected	generic	['x64-based_systems']

Microsoft

Windows Server 2025 (server Core Installation)

Version	Status	Scheme	Platform
`[10.0.26100.0,10.0.26100.33158)`	affected	generic	['x64-based_systems']

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Install the latest Windows security update that contains the fix for CVE‑2026‑50381 on all affected systems.
Restrict local accounts to only the privileges required for their duties and disable local administrative privileges unless absolutely necessary.
If the Composite Image File System driver is not needed for your environment, disable it via Group Policy or equivalent device configuration to eliminate the attack surface.

Generated by OpenCVE AI on July 31, 2026 at 08:43 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.404% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50381

History

Nov 11, 2026 1:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Microsoft windows Server 2025 (server Core Installation)
Vendors & Products		Microsoft windows Server 2025 (server Core Installation)

Jul 15, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 14, 2026 5:15 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Access of resource using incompatible type ('type confusion') in Composite Image File System Driver allows an authorized attacker to disclose information locally.
Title		Composite Image File System driver (cimfs.sys) Information Disclosure Vulnerability
First Time appeared		Microsoft Microsoft windows 10 21h2 Microsoft windows 10 22h2 Microsoft windows 11 24h2 Microsoft windows 11 25h2 Microsoft windows 11 26h1 Microsoft windows Server 2022 Microsoft windows Server 2025
Weaknesses		CWE-843
CPEs		cpe:2.3:o:microsoft:windows_10_21H2:::::::x86:* cpe:2.3:o:microsoft:windows_10_22H2:::::::x64:* cpe:2.3:o:microsoft:windows_11_24H2:::::::arm64:* cpe:2.3:o:microsoft:windows_11_25H2:::::::arm64:* cpe:2.3:o:microsoft:windows_11_26H1:::::::x64:* cpe:2.3:o:microsoft:windows_server_2022:::::::: cpe:2.3:o:microsoft:windows_server_2025::::::::
Vendors & Products		Microsoft Microsoft windows 10 21h2 Microsoft windows 10 22h2 Microsoft windows 11 24h2 Microsoft windows 11 25h2 Microsoft windows 11 26h1 Microsoft windows Server 2022 Microsoft windows Server 2025
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50381
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C'}`

Subscriptions

Microsoft Windows 10 21h2 Windows 10 21h2 Windows 10 22h2 Windows 10 22h2 Windows 11 24h2 Windows 11 24h2 Windows 11 25h2 Windows 11 25h2 Windows 11 26h1 Windows 11 26h1 Windows Server 2022 Windows Server 2025 Windows Server 2025 (server Core Installation)

Weaknesses