Win32k Information Disclosure Vulnerability
MonitorCVSS 5.5CVE-2026-70295Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. The vulnerability affects Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 across various versions and architectures.
What this means
What could happen
An attacker with local access to a Windows workstation or server could read sensitive data from system memory, potentially exposing configuration information or process data. This is a local information disclosure vulnerability with no impact on system availability or integrity.
Who's at risk
This vulnerability affects IT/OT environments running Windows on engineering workstations, SCADA servers, HMI systems, or any industrial control system workstations. Specifically impacts Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2016/2019/2022/2025 systems in any architecture (32-bit, x64, ARM64).
How it could be exploited
An attacker would need to execute code locally on the affected Windows system with standard user privileges. The attacker could then trigger the out-of-bounds read in the Win32 Kernel Subsystem to access sensitive data in kernel memory. This is not remotely exploitable and requires local system access.
Prerequisites
- Local access to the affected Windows system
- Standard user-level privileges (no admin required)
- Ability to execute code locally on the system
Local access only (not remotely exploitable)Low complexity attackInformation disclosure only (no code execution)
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXApply Microsoft's October 2026 security update for your Windows version
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/1f5c2278-ef95-4a7a-a5d8-543045812410Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.