cve 2026 50309

The cve 2026 50309 tag covers reporting on Microsoft’s July 14, 2026 security updates and their fix for a high-severity heap-based buffer overflow in Windows NTFS. The vulnerability could allow an authenticated attacker with low-level privileges on a vulnerable computer to execute code locally. Although Microsoft classifies it under Remote Code Execution, the documented attack vector is local rather than an unauthenticated network attack. Coverage also notes the CVSS 3.1 score of 7.8, an Important severity rating, and Microsoft’s assessment that exploitation was less likely and had not been publicly disclosed or observed in the wild at the time of publication.