OTPulse

Win32k Information Disclosure Vulnerability

MonitorCVSS 5.5CVE-2026-70288Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

A time-of-check time-of-use (TOCTOU) race condition in the Windows Win32 Kernel Subsystem allows an authenticated local attacker to read sensitive information from kernel memory. The vulnerability exists in Win32k and can be exploited by rapidly alternating between security checks and memory reads to bypass access controls. An attacker with valid user credentials on the machine could leverage this to disclose system configuration, kernel data, or other protected information.

What this means
What could happen
A local attacker with user credentials could read sensitive data from Windows kernel memory through a timing vulnerability. This could expose system configuration, credentials, or other protected information resident on the machine.
Who's at risk
Organizations running Windows 10, Windows 11, Windows Server 2016, 2019, 2022, or 2025. This affects any Windows endpoint or server that accepts interactive logins or has local users. Most relevant to environments where shared workstations or RDP access is in use, or where contractor/temporary staff have local machine access.
How it could be exploited
An attacker with local login access to the machine exploits a race condition in Win32k by rapidly checking and then reading kernel memory in a tight timing window. The vulnerability exists between the security check (time-of-check) and the actual data read (time-of-use), allowing the attacker to bypass access controls and read sensitive kernel data.
Prerequisites
  • Valid local user account credentials on the Windows machine
  • Local code execution capability (ability to run programs on the machine)
  • Physical or remote desktop access to the affected Windows system
requires local user credentialslow complexity attacklow EPSS score (0.3%)affects all major Windows versions
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9376
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9376
Windows Server 2019All versionsBuild 10.0.17763.9376
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9376
Windows Server 2022All versionsBuild 10.0.20348.5761
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply October 2026 Windows security update (Build 10.0.17763.9376 for Server 2019/Win10 v1809, Build 10.0.20348.5761 for Server 2022, Build 10.0.19044.7807 for Win10 v21H2, Build 10.0.22631.7652 for Win11 v23H2, or equivalent for your OS version)
Long-term hardening
0/2
HARDENINGRestrict local machine access and login permissions to authorized users only
HARDENINGReview and disable unnecessary local user accounts
View full vendor advisory
API: /api/v1/advisories/0b50e8c9-0623-45c9-9d01-b01995551cb2

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.