Win32k Information Disclosure Vulnerability
MonitorCVSS 5.5CVE-2026-70290Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized local attacker to disclose sensitive information. The vulnerability exists in the graphics system kernel component and requires local access and valid user credentials to exploit.
What this means
What could happen
A local user with valid credentials could read sensitive kernel memory that should not be accessible to them, potentially exposing system secrets or configuration data. This information disclosure could aid further compromise of the system.
Who's at risk
Windows system administrators and IT teams managing Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 environments. This affects both standard server and Server Core installations across 32-bit, 64-bit, and ARM64 architectures. Any organization running affected Windows versions should apply the patch during their regular maintenance window.
How it could be exploited
An attacker with valid local user credentials could call Windows graphics APIs to trigger the uninitialized memory read, extracting sensitive kernel data without administrator privileges. The attacker needs to be logged in or have interactive console access.
Prerequisites
- Valid local user account credentials
- Interactive logon or remote desktop session access
- Ability to call Win32 graphics kernel APIs
Requires valid local credentialsLocal access only (not remotely exploitable)Affects all major Windows versionsVendor fix available
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/2
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXApply Microsoft September 2026 security update to patch CVE-2026-70290
Long-term hardening
0/1HARDENINGRestrict local logon and remote desktop access to trusted users only
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/8271c25b-a536-46fc-9e0a-cd597b166362Get OT security insights every Tuesday
Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.