Microsoft Windows Win32k: Information disclosure through uninitialized resource

Summary

A local flaw in the Win32k kernel-mode graphics component of Windows allows an authorized user to read uninitialized kernel memory. An attacker needs a local account with low privileges, so the flaw is not directly reachable from the internet. Successful exploitation can disclose sensitive information, which is often a step in a longer attack chain, so multi-user systems carry the most risk.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9688
• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
• Windows Server 2016 (including Server Core): 10.0.14393.0 to before 10.0.14393.9688
• Windows Server 2019 (including Server Core): 10.0.17763.0 to before 10.0.17763.9487
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870

Fixed in

• Install the November 2026 security updates for the affected Windows version.
• Fixed builds per the CVE record: 10.0.14393.9688, 10.0.17763.9487, 10.0.19044.7846, 10.0.19045.7846, 10.0.22631.7711, 10.0.26100.9974, 10.0.26200.9974, 10.0.28000.3501, 10.0.26300.9974, 10.0.20348.5870.
• Third-party pages list KB5131085 (Windows 10 1809 and Server 2019) and KB5131090 (Server 2022). Verify KB numbers in the Microsoft Update Guide before deployment.
• Unknown: KB numbers for Windows 10 1607, Windows 11 23H2 and 24H2, and Server 2016 and 2025.

Workaround

• None known. Microsoft lists no workaround.
• Limit local logon rights on shared and multi-user systems as a risk reduction until patching is complete.

Exploitation

• No known exploitation in the wild.
• Not listed in the CISA KEV catalog according to a third-party page.
• CISA SSVC: exploitation none, not automatable, partial technical impact.
• Microsoft temporal metrics: exploit code maturity unproven, report confidence confirmed.
• Rapid7 rates exploitation as less likely and the vulnerability as not publicly disclosed.
• No public proof of concept found.

Our recommendation

• Apply the November 2026 cumulative security update to all affected Windows systems, prioritising terminal servers, RDS hosts and shared workstations.
• Review which accounts have local logon rights on servers and shared systems and remove unneeded access.
• Check the Microsoft Update Guide to confirm KB numbers and fixed builds before rollout.
• Monitor for unusual local logons and privilege activity until patches are in place.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE record (CNA: Microsoft) www.cve.org
• MSRC Security Update Guide msrc.microsoft.com
• Rapid7 November 2026 Patch Tuesday analysis www.rapid7.com
• Senserva KB5131085 (Server 2019 / 1809) senserva.com
• Senserva KB5131090 (Server 2022) senserva.com
• Strix.ai (third-party aggregator) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 16:35.