Executive brief
A security vulnerability has been identified in the Windows Kernel, the core component of the Microsoft Windows operating system. This flaw allows an unauthorized person to access sensitive information from a computer's memory over a network without needing a username or password. If exploited, this could lead to the exposure of private data or system secrets, potentially aiding further attacks against the organization.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists within the Windows Kernel. The flaw is triggered when the kernel improperly handles memory buffers, allowing a remote, unauthenticated attacker to read data outside of the intended memory range. The attack vector is network-based and requires no user interaction or special privileges. Successful exploitation results in the disclosure of sensitive information from kernel memory. Microsoft has released security updates to address this issue across affected versions of Windows 10, Windows 11, and Windows Server.
Affected products
- Microsoft Windows 10 1809, 21H2, 22H2
- Microsoft Windows 11 24H2, 25H2, 26H1
- Microsoft Windows Server 2019 All versions
- Microsoft Windows Server 2022 All versions
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory