OTPulse

Win32k Information Disclosure Vulnerability

MonitorCVSS 5.5CVE-2026-62746Aug 11, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

A buffer over-read vulnerability in Windows Win32K (the kernel graphics driver) allows a logged-in user to disclose information from kernel memory. An authorized attacker with local system access could exploit this to read sensitive data that should not be accessible from user-mode applications. Microsoft has released patches for Windows 10 versions 1607, 1809, 21H2, 22H2, Windows 11 versions 23H2 through 26H1, and Windows Server 2016, 2019, 2022, and 2025.

What this means
What could happen
A logged-in user on a Windows system could read sensitive information from the kernel graphics system (Win32k) without authorization, potentially exposing configuration data or other sensitive memory contents.
Who's at risk
Windows 10 (all recent versions including 1607, 1809, 21H2, 22H2), Windows 11 (all versions 23H2 through 26H1), Windows Server 2016, 2019, 2022, and 2025 systems. Affects both IT environments and any OT systems running Windows for Human-Machine Interface (HMI), engineering workstations, or supervisory control systems.
How it could be exploited
An attacker with local logon access runs code that triggers a buffer over-read in the Windows kernel graphics driver (Win32k), causing the kernel to disclose unintended memory data back to the user-mode process.
Prerequisites
  • Local system access (user account logon required)
  • Ability to run user-mode applications on the target system
Requires local user accessBuffer over-read could expose sensitive kernel memoryAffects multiple Windows versions
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9115
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9115
Windows Server 2019All versionsBuild 10.0.17763.9115
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9115
Windows Server 2022All versionsBuild 10.0.20348.5499
Remediation & Mitigation
0/2
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply Microsoft's August 2026 security update to Windows 10 or Windows Server systems
Long-term hardening
0/1
HARDENINGIf immediate patching is not possible, restrict local logon to trusted users only
View full vendor advisory
API: /api/v1/advisories/12f30930-3c2b-45e2-9315-2b43d1b50f3f

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Win32k Information Disclosure Vulnerability | CVSS 5.5 - OTPulse