OTPulse

Win32k Information Disclosure Vulnerability

MonitorCVSS 5.5CVE-2026-83755Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

A vulnerability in Windows Win32K (the kernel-mode driver that handles windowing and graphics) allows an authorized local user to read uninitialized kernel memory, disclosing sensitive information. The vulnerability affects Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 across all architectures (32-bit, x64, ARM64). Exploitation requires local system access and does not require elevated privileges. Microsoft rates exploitation as less likely and has released fixes in the October 2026 security update.

What this means
What could happen
A local user on a Windows system could read sensitive information from kernel memory that should be protected. This is primarily a data confidentiality risk rather than a direct operational control risk.
Who's at risk
Organizations running Windows 10, Windows 11, Windows Server 2016, 2019, 2022, or 2025 should apply security updates. This affects both IT workstations and servers used for administrative access to industrial systems. Industrial facilities using Windows-based engineering workstations, HMIs (human-machine interfaces), or data historian systems are in scope.
How it could be exploited
An attacker with local access to a Windows workstation or server could interact with Win32k driver components to trigger an uninitialized resource condition, reading sensitive kernel memory that may contain passwords, session tokens, or other confidential data.
Prerequisites
  • Local access to the Windows system (user account on the machine)
  • No special privileges required beyond standard user account
Requires local access to exploitLow EPSS score (0.4%)Not actively exploitedAffects Windows core kernel drivers
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9376
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9376
Windows Server 2019All versionsBuild 10.0.17763.9376
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9376
Windows Server 2022All versionsBuild 10.0.20348.5761
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

Windows Server 2016
HOTFIXApply the October 2026 Windows security update to your Windows Server 2016, 2019, 2022, and 2025 systems
All products
HOTFIXApply the October 2026 Windows security update to your Windows 10 and Windows 11 systems
Long-term hardening
0/1
HARDENINGRestrict local system access to IT staff and authorized personnel only; avoid granting unnecessary user accounts on operational servers
View full vendor advisory
API: /api/v1/advisories/d648d025-0c3e-49f2-a098-921e18274387

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Win32k Information Disclosure Vulnerability | CVSS 5.5 - OTPulse