CVE-2026-50412 is a high-severity Windows NTFS vulnerability that allows a locally authenticated attacker to elevate privileges through a stack-based buffer overflow. Microsoft released the fix on July 14, 2026, as part of its monthly Windows security updates, covering supported Windows 10, Windows 11, and Windows Server installations.
Microsoft rates the flaw Important, with a CVSS 3.1 base score of 7.8. As detailed in the Microsoft Security Response Center advisory and the CVE record submitted to the National Vulnerability Database, exploitation requires local access and low-level privileges, but it does not require user interaction.
For administrators, the immediate action is straightforward: deploy the July 2026 cumulative security update and verify that endpoints have reached the corrected OS build. The vulnerability was not publicly disclosed or known to be exploited when Microsoft published the advisory, and Microsoft assessed exploitation as less likely.
CVE-2026-50412 is not a drive-by vulnerability that an unauthenticated attacker can trigger directly across the internet. Its CVSS vector,
That prerequisite limits the initial attack surface, but it does not make the vulnerability harmless. Local privilege-escalation flaws are commonly used after an attacker has obtained access through phishing, stolen credentials, a vulnerable application, malicious software, or an exposed remote-management service.
The flaw could then provide the transition from an ordinary user context to a more powerful security context. Microsoft’s scoring assigns high potential impact to confidentiality, integrity, and availability, indicating that successful exploitation could let an attacker access protected information, alter system resources, and disrupt the affected computer.
No user interaction is required once the attacker is operating locally. That matters on shared workstations, Remote Desktop Session Hosts, development systems, virtual desktop infrastructure, and servers where users or applications run with restricted accounts.
The affected component is NTFS, the default file system used by modern Windows installations. Because NTFS sits deep within Windows storage handling, administrators should not expect application allow-listing or browser protections alone to neutralize the underlying defect.
The public description remains deliberately narrow. Microsoft has not published the exact NTFS operation, malformed structure, or proof-of-concept sequence needed to reach the vulnerable code path. That limits immediate defensive engineering outside the official update, but it also withholds useful implementation details from would-be attackers.
The advisory’s report-confidence assessment is Confirmed. In CVSS terminology, that means the vulnerability’s existence and technical basis have been validated through sufficiently credible evidence, such as detailed reports, reproducible behavior, source-level confirmation, or acknowledgement by the affected vendor.
Report confidence should not be confused with active exploitation. A confirmed vulnerability is one Microsoft accepts as real; it does not mean attackers are already using it in the wild. At publication, Microsoft’s exploitability data indicated that CVE-2026-50412 was not publicly disclosed and had not been detected in attacks.
Microsoft also classified exploitation as less likely for the latest supported software release. That assessment can help prioritize emergency response, but it is not a reason to defer the patch indefinitely. Once monthly updates are available, researchers and attackers can compare corrected and uncorrected NTFS binaries—a process known as patch diffing—to narrow down the changed code.
Microsoft’s affected-product data gives the following corrected build boundaries for several prominent client releases:
The broader July release also associates CVE-2026-50412 with updates including KB5099444, KB5099445, KB5099535, KB5099536, KB5099538, KB5099539, KB5099540, KB5101649, and KB5101650. The applicable package depends on the Windows edition, servicing channel, architecture, and support arrangement.
Some of the listed Windows 10 versions survive primarily through Long-Term Servicing Channel editions or paid support programs rather than ordinary consumer support. Administrators should therefore verify both build compliance and entitlement to security servicing, particularly for Windows 10 21H2 and 22H2 devices retained for legacy applications.
Administrators can check the installed build by running
Servers deserve particular attention because local privilege escalation can amplify a compromise of a service account, management agent, backup component, or interactive administrative environment. Server Core remains affected despite its reduced interface and smaller application footprint, since the vulnerable NTFS functionality is part of the operating system rather than the graphical shell.
Microsoft lists no separate mitigation or workaround that provides the same protection as the security update. Restricting interactive logons, reducing local account use, controlling software execution, and monitoring suspicious privilege changes can make exploitation harder or improve detection, but those measures do not repair the buffer overflow.
The operational priority is therefore to move supported systems onto the July 14, 2026 security baseline, restart where required, and confirm the final build after deployment. CVE-2026-50412 may require an attacker to secure an initial foothold first, but leaving it unpatched risks turning a limited account into control of the entire Windows machine.
Microsoft rates the flaw Important, with a CVSS 3.1 base score of 7.8. As detailed in the Microsoft Security Response Center advisory and the CVE record submitted to the National Vulnerability Database, exploitation requires local access and low-level privileges, but it does not require user interaction.
For administrators, the immediate action is straightforward: deploy the July 2026 cumulative security update and verify that endpoints have reached the corrected OS build. The vulnerability was not publicly disclosed or known to be exploited when Microsoft published the advisory, and Microsoft assessed exploitation as less likely.
A Local Foothold Can Become a Full Compromise
CVE-2026-50412 is not a drive-by vulnerability that an unauthenticated attacker can trigger directly across the internet. Its CVSS vector, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, describes a local attack requiring an existing low-privilege account or another way to execute code on the target.That prerequisite limits the initial attack surface, but it does not make the vulnerability harmless. Local privilege-escalation flaws are commonly used after an attacker has obtained access through phishing, stolen credentials, a vulnerable application, malicious software, or an exposed remote-management service.
The flaw could then provide the transition from an ordinary user context to a more powerful security context. Microsoft’s scoring assigns high potential impact to confidentiality, integrity, and availability, indicating that successful exploitation could let an attacker access protected information, alter system resources, and disrupt the affected computer.
No user interaction is required once the attacker is operating locally. That matters on shared workstations, Remote Desktop Session Hosts, development systems, virtual desktop infrastructure, and servers where users or applications run with restricted accounts.
The affected component is NTFS, the default file system used by modern Windows installations. Because NTFS sits deep within Windows storage handling, administrators should not expect application allow-listing or browser protections alone to neutralize the underlying defect.
The Bug Is a Confirmed Stack Overflow
Microsoft identifies CWE-121, a stack-based buffer overflow, as the underlying weakness. This class of vulnerability occurs when software writes more data to a stack-allocated buffer than it was designed to hold, potentially corrupting adjacent control information or program state.The public description remains deliberately narrow. Microsoft has not published the exact NTFS operation, malformed structure, or proof-of-concept sequence needed to reach the vulnerable code path. That limits immediate defensive engineering outside the official update, but it also withholds useful implementation details from would-be attackers.
The advisory’s report-confidence assessment is Confirmed. In CVSS terminology, that means the vulnerability’s existence and technical basis have been validated through sufficiently credible evidence, such as detailed reports, reproducible behavior, source-level confirmation, or acknowledgement by the affected vendor.
Report confidence should not be confused with active exploitation. A confirmed vulnerability is one Microsoft accepts as real; it does not mean attackers are already using it in the wild. At publication, Microsoft’s exploitability data indicated that CVE-2026-50412 was not publicly disclosed and had not been detected in attacks.
Microsoft also classified exploitation as less likely for the latest supported software release. That assessment can help prioritize emergency response, but it is not a reason to defer the patch indefinitely. Once monthly updates are available, researchers and attackers can compare corrected and uncorrected NTFS binaries—a process known as patch diffing—to narrow down the changed code.
Support Spans Windows 10 Through Windows 11 26H1
The CVE record identifies a broad set of affected Windows releases. Client exposure includes Windows 10 versions 1607, 1809, 21H2, and 22H2, as well as Windows 11 versions 24H2, 25H2, and 26H1.Microsoft’s affected-product data gives the following corrected build boundaries for several prominent client releases:
- Windows 10 version 1607 is affected before build 14393.9339.
- Windows 10 version 1809 is affected before build 17763.9020.
- Windows 10 version 21H2 is affected before build 19044.7548.
- Windows 10 version 22H2 is affected before build 19045.7548.
- Windows 11 version 24H2 is affected before build 26100.8875.
- Windows 11 version 25H2 is affected before build 26200.8875.
- Windows 11 version 26H1 is affected before build 28000.2525.
The broader July release also associates CVE-2026-50412 with updates including KB5099444, KB5099445, KB5099535, KB5099536, KB5099538, KB5099539, KB5099540, KB5101649, and KB5101650. The applicable package depends on the Windows edition, servicing channel, architecture, and support arrangement.
Some of the listed Windows 10 versions survive primarily through Long-Term Servicing Channel editions or paid support programs rather than ordinary consumer support. Administrators should therefore verify both build compliance and entitlement to security servicing, particularly for Windows 10 21H2 and 22H2 devices retained for legacy applications.
Patch Verification Matters More Than the CVE Count
CVE-2026-50412 arrived in an unusually large July security release containing numerous additional NTFS vulnerabilities. That volume makes it easy for individual flaws to disappear into vulnerability-management dashboards, even though the practical response remains tied to a single cumulative Windows update.Administrators can check the installed build by running
winver, querying inventory through Microsoft Intune or Configuration Manager, or using PowerShell and their endpoint-management platform. Security teams should compare the resulting revision against Microsoft’s corrected build for that specific Windows branch rather than merely checking whether an update installation was attempted.Servers deserve particular attention because local privilege escalation can amplify a compromise of a service account, management agent, backup component, or interactive administrative environment. Server Core remains affected despite its reduced interface and smaller application footprint, since the vulnerable NTFS functionality is part of the operating system rather than the graphical shell.
Microsoft lists no separate mitigation or workaround that provides the same protection as the security update. Restricting interactive logons, reducing local account use, controlling software execution, and monitoring suspicious privilege changes can make exploitation harder or improve detection, but those measures do not repair the buffer overflow.
The operational priority is therefore to move supported systems onto the July 14, 2026 security baseline, restart where required, and confirm the final build after deployment. CVE-2026-50412 may require an attacker to secure an initial foothold first, but leaving it unpatched risks turning a limited account into control of the entire Windows machine.
References
- Primary source: MSRC
Published: 2026-07-14T07:00:00-07:00
Security Update Guide - Microsoft Security Response Center
msrc.microsoft.com
