CVE-2026-50396

Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

Published Jul 14, 2026 CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Description

Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.

Analysis

Technical impact

A use‑after‑free flaw in certain Windows kernel‑mode drivers allows an authorized user to execute code after memory has already been freed. This can grant the attacker higher privileges on the system. The weakness is identified as CWE‑416 and directly undermines operating‑system integrity.

Affected Systems

Microsoft Windows 11 24H2, 25H2, and 26H1 and Windows Server 2025, including Server Core, are affected; the 24H2 and 25H2 builds are vulnerable on arm64, while the 26H1 build is affected on x64.

Risk and Exploitability

The CVSS base score of 7 indicates medium severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The attack vector is local: a user or process with sufficient privileges to interact with the faulty driver can trigger the flaw. Based on the description, it is inferred that no public exploit has been observed.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Microsoft

Windows 11 Version 24H2

affected

Version	Status	Constraints
`10.0.26100.0`	affected	< 10.0.26100.8875

Microsoft

Windows 11 Version 25H2

affected

Version	Status	Constraints
`10.0.26200.0`	affected	< 10.0.26200.8875

Microsoft

Windows 11 version 26H1

affected

Version	Status	Constraints
`10.0.28000.0`	affected	< 10.0.28000.2525

Microsoft

Windows Server 2025

affected

Version	Status	Constraints
`10.0.26100.0`	affected	< 10.0.26100.33158

Microsoft

Windows Server 2025 (Server Core installation)

affected

Version	Status	Constraints
`10.0.26100.0`	affected	< 10.0.26100.33158

Configuration 1 [-]

OR	cpe:2.3:o:microsoft:windows_11_24h2::::::::
	cpe:2.3:o:microsoft:windows_11_25h2::::::::
	cpe:2.3:o:microsoft:windows_11_26h1:::::::x64:*
	cpe:2.3:o:microsoft:windows_11_26h1:::::::arm64:*
	cpe:2.3:o:microsoft:windows_server_2025::::::::

No data.

Vendor Product Versions

Microsoft

Windows 11 24h2

Version	Status	Scheme	Platform
`[10.0.26100.0,10.0.26100.8875)`	affected	generic	['arm64-based_systems', 'x64-based_systems']

Microsoft

Windows 11 25h2

Version	Status	Scheme	Platform
`[10.0.26200.0,10.0.26200.8875)`	affected	generic	['arm64-based_systems', 'x64-based_systems']

Microsoft

Windows 11 26h1

Version	Status	Scheme	Platform
`[10.0.28000.0,10.0.28000.2525)`	affected	generic	['arm64-based_systems', 'x64-based_systems']

Microsoft

Windows Server 2025

Version	Status	Scheme	Platform
`[10.0.26100.0,10.0.26100.33158)`	affected	generic	['x64-based_systems']

Microsoft

Windows Server 2025 (server Core Installation)

Version	Status	Scheme	Platform
`[10.0.26100.0,10.0.26100.33158)`	affected	generic	['x64-based_systems']

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the Microsoft security update that fixes the kernel‑mode driver issue (refer to the MSRC advisory).
Segregate local accounts to only the privileges required for their functions and remove unnecessary administrative rights.
If the vulnerable driver is nonessential, disable or restrict its execution on the affected systems.

Generated by OpenCVE AI on August 1, 2026 at 09:43 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.279% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50396

History

Nov 11, 2026 12:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Microsoft windows Server 2025 (server Core Installation)
Vendors & Products		Microsoft windows Server 2025 (server Core Installation)

Jul 15, 2026 11:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jul 14, 2026 5:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
Title		Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
First Time appeared		Microsoft Microsoft windows 11 24h2 Microsoft windows 11 25h2 Microsoft windows 11 26h1 Microsoft windows Server 2025
Weaknesses		CWE-416
CPEs		cpe:2.3:o:microsoft:windows_11_24H2:::::::arm64:* cpe:2.3:o:microsoft:windows_11_25H2:::::::arm64:* cpe:2.3:o:microsoft:windows_11_26H1:::::::x64:* cpe:2.3:o:microsoft:windows_server_2025::::::::
Vendors & Products		Microsoft Microsoft windows 11 24h2 Microsoft windows 11 25h2 Microsoft windows 11 26h1 Microsoft windows Server 2025
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50396
Metrics		cvssV3_1 `{'score': 7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}`

Subscriptions

Microsoft Windows 11 24h2 Windows 11 24h2 Windows 11 25h2 Windows 11 25h2 Windows 11 26h1 Windows 11 26h1 Windows Server 2025 Windows Server 2025 (server Core Installation)

Weaknesses