Win32k Information Disclosure Vulnerability
MonitorCVSS 5.5CVE-2026-70284Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
An uninitialized resource vulnerability in the Windows Win32k kernel subsystem allows an authorized local user to read sensitive information from kernel memory. This is a local information disclosure issue affecting Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025.
What this means
What could happen
An authorized user on a Windows system could read sensitive information from kernel memory that should not be accessible, potentially exposing configuration details, credentials, or other data used by system processes.
Who's at risk
Organizations running Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022, or Windows Server 2025 are affected. This impacts any system where non-administrator users have local login access, including engineering workstations, operator terminals, and administrative servers in industrial facilities.
How it could be exploited
An attacker with a local user account on a Windows system could interact with the Win32k kernel subsystem to access uninitialized memory regions and retrieve sensitive information without elevated privileges.
Prerequisites
- Local user account on affected Windows system
- No administrative or special privileges required
Low exploit probabilityRequires local accessAffects widely deployed operating systemsInformation disclosure could expose sensitive operational data
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXApply Microsoft's October 2026 security update for your Windows version
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/e14634d3-62c3-4061-b4f3-eae62fe0f66fGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.