OTPulse

Win32k Information Disclosure Vulnerability

MonitorCVSS 5.5CVE-2026-62798Aug 11, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

An untrusted pointer dereference in Windows Win32k subsystem allows a local authorized user to disclose sensitive information from kernel memory. The vulnerability affects Windows Server 2025 and Windows 11 (all recent versions including 23H2, 24H2, 25H2, and 26H1) on both x64 and ARM64 architectures.

What this means
What could happen
A local attacker with standard user access can read sensitive data from kernel memory, potentially exposing system secrets or credentials. This poses a minimal risk to OT systems since it requires local logon access and only leaks information without enabling process disruption.
Who's at risk
Windows server operators and administrators on systems running Windows Server 2025, Windows 11 (versions 23H2, 24H2, 25H2, 26H1) on x64 and ARM64 architectures. Any HMI workstations or engineering stations running these Windows versions are affected.
How it could be exploited
An attacker with an active local user account on a Windows server or workstation can trigger an untrusted pointer dereference in the Win32k subsystem to read memory contents. This requires local logon; remote exploitation is not possible.
Prerequisites
  • Local user account on affected Windows system
  • Interactive logon access
  • Ability to execute code or trigger Win32k API calls
requires local user accesslow EPSS score (0.3%)information disclosure only (no code execution or availability impact)
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (10)
10 with fix
ProductAffected VersionsFix Status
Windows Server 2025 (Server Core installation)All versionsBuild 10.0.26100.33296
Windows 11 Version 25H2 for ARM64-based SystemsAll versionsBuild 10.0.26200.9168
Windows 11 Version 25H2 for x64-based SystemsAll versionsBuild 10.0.26200.9168
Windows 11 Version 23H2 for ARM64-based SystemsAll versionsBuild 10.0.22631.7517
Windows 11 Version 23H2 for x64-based SystemsAll versionsBuild 10.0.22631.7517
Windows 11 Version 24H2 for ARM64-based SystemsAll versionsBuild 10.0.26200.9106
Windows 11 Version 24H2 for x64-based SystemsAll versionsBuild 10.0.26100.9168
Windows Server 2025All versionsBuild 10.0.26100.33296
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply the 2026-August Microsoft security update to all affected Windows servers and workstations
View full vendor advisory
API: /api/v1/advisories/3d2b3f4f-67ea-4de1-b4c4-8384c7fdcfd5

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.