Win32k Information Disclosure Vulnerability
MonitorCVSS 5.5CVE-2026-70294Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
An out-of-bounds read vulnerability in Windows Win32 Kernel Subsystem allows an authorized local user to disclose sensitive kernel memory information. The vulnerability requires local access and standard user privileges. Microsoft has released patches for all affected Windows versions and server variants. Exploitation is assessed as less likely in practical scenarios.
What this means
What could happen
An attacker with local access to a Windows machine can read sensitive information from kernel memory, potentially exposing configuration data, credentials, or other system secrets.
Who's at risk
Organizations running Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022, or Windows Server 2025 across all supported versions and architectures. This impacts any IT infrastructure using these operating systems, including HMI workstations, engineering stations, historian servers, and administrative interfaces in industrial facilities.
How it could be exploited
An attacker with an authorized local account on the Windows machine exploits an out-of-bounds read flaw in the Win32 kernel subsystem to access and disclose sensitive kernel memory contents without triggering safeguards.
Prerequisites
- Local user account with standard privileges
- Local access to the affected Windows machine
- Ability to execute code or scripts on the system
Low complexity exploitationAffects machines with local users (internal staff)Requires local account (not remotely exploitable)
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXInstall the October 2026 Windows security update for your Windows version and architecture
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/1384eebb-ed3d-49dc-98fb-0ecbdd5e3bdaGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.