OTPulse

Win32k Information Disclosure Vulnerability

MonitorCVSS 5.5CVE-2026-69808Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

Out-of-bounds read vulnerability in Windows Win32k kernel graphics driver. An authorized local user can trigger the flaw to disclose sensitive kernel memory contents, potentially exposing passwords, encryption keys, or other confidential data. Affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H1), Windows Server 2016, 2019, 2022, and 2025.

What this means
What could happen
An authorized local user could read sensitive information from Windows kernel memory through a flaw in the Win32k graphics driver. This could expose passwords, encryption keys, or other confidential data on workstations or servers.
Who's at risk
IT staff and system administrators managing Windows 10, Windows 11, or Windows Server 2016/2019/2022/2025 systems in offices, data centers, or hybrid environments should ensure these systems receive the latest security patches. This affects both standard installations and Server Core deployments across 32-bit, 64-bit, and ARM64 architectures.
How it could be exploited
An attacker with a local user account could craft a malicious application or interact with Win32k APIs to trigger an out-of-bounds memory read, bypassing normal access controls to view kernel memory contents.
Prerequisites
  • Local user account on the affected Windows system
  • Ability to run applications or execute code locally
Low complexity attackRequires valid user accountInformation disclosure only (no code execution)
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9245
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9245
Windows Server 2019All versionsBuild 10.0.17763.9245
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9245
Windows Server 2022All versionsBuild 10.0.20348.5622
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply the September 2026 Windows security update to all affected systems
View full vendor advisory
API: /api/v1/advisories/8235fe40-8d5f-4bf9-8fb9-a5f86b4af98c

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Win32k Information Disclosure Vulnerability | CVSS 5.5 - OTPulse