CVE-2026-24282

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24282", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2026-01-21T21:28:02.967Z", "datePublished": "2026-03-10T17:04:39.143Z", "dateUpdated": "2026-06-19T18:17:26.147Z"}, "containers": {"cna": {"title": "Push message Routing Service Elevation of Privilege Vulnerability", "datePublic": "2026-03-10T14:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_11_26H1:*:*:*:*:*:*:arm64:*", "versionStartIncluding": "10.0.28000.0", "versionEndExcluding": "10.0.28000.1719"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*", "versionStartIncluding": "10.0.17763.0", "versionEndExcluding": "10.0.17763.8511"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_10_21H2:*:*:*:*:*:*:x86:*", "versionStartIncluding": "10.0.19044.0", "versionEndExcluding": "10.0.19044.7058"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_10_22H2:*:*:*:*:*:*:x64:*", "versionStartIncluding": "10.0.19045.0", "versionEndExcluding": "10.0.19045.7058"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_11_25H2:*:*:*:*:*:*:arm64:*", "versionStartIncluding": "10.0.26200.0", "versionEndExcluding": "10.0.26200.8037"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:arm64:*", "versionStartIncluding": "10.0.22631.0", "versionEndExcluding": "10.0.22631.6783"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:x64:*", "versionStartIncluding": "10.0.22631.0", "versionEndExcluding": "10.0.22631.6783"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_11_24H2:*:*:*:*:*:*:arm64:*", "versionStartIncluding": "10.0.26100.0", "versionEndExcluding": "10.0.26100.8037"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*", "versionStartIncluding": "10.0.14393.0", "versionEndExcluding": "10.0.14393.8957"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Windows 10 Version 1607", "platforms": ["32-bit Systems", "x64-based Systems"], "versions": [{"version": "10.0.14393.0", "lessThan": "10.0.14393.8957", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows 10 Version 1809", "platforms": ["32-bit Systems", "x64-based Systems"], "versions": [{"version": "10.0.17763.0", "lessThan": "10.0.17763.8511", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows 10 Version 21H2", "platforms": ["32-bit Systems", "ARM64-based Systems", "x64-based Systems"], "versions": [{"version": "10.0.19044.0", "lessThan": "10.0.19044.7058", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows 10 Version 22H2", "platforms": ["32-bit Systems", "ARM64-based Systems", "x64-based Systems"], "versions": [{"version": "10.0.19045.0", "lessThan": "10.0.19045.7058", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows 11 version 22H3", "platforms": ["ARM64-based Systems"], "versions": [{"version": "10.0.22631.0", "lessThan": "10.0.22631.6783", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows 11 Version 23H2", "platforms": ["x64-based Systems"], "versions": [{"version": "10.0.22631.0", "lessThan": "10.0.22631.6783", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows 11 Version 24H2", "platforms": ["ARM64-based Systems", "x64-based Systems"], "versions": [{"version": "10.0.26100.0", "lessThan": "10.0.26100.8037", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows 11 Version 25H2", "platforms": ["ARM64-based Systems", "x64-based Systems"], "versions": [{"version": "10.0.26200.0", "lessThan": "10.0.26200.8037", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows 11 version 26H1", "platforms": ["ARM64-based Systems", "x64-based Systems"], "versions": [{"version": "10.0.28000.0", "lessThan": "10.0.28000.1719", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Out-of-bounds read in Push Message Routing Service allows an authorized attacker to disclose information locally.", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-125: Out-of-bounds Read", "lang": "en-US", "type": "CWE", "cweId": "CWE-125"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-06-19T18:17:26.147Z"}, "references": [{"name": "Push message Routing Service Elevation of Privilege Vulnerability", "tags": ["vendor-advisory", "patch"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24282"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "MEDIUM", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-12T14:27:00.509817Z", "id": "CVE-2026-24282", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T14:27:09.392Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24282", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-12T14:27:00.509817Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T14:27:06.154Z"}}], "cna": {"title": "Push message Routing Service Elevation of Privilege Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": "Windows 10 Version 1607", "versions": [{"status": "affected", "version": "10.0.14393.0", "lessThan": "10.0.14393.8957", "versionType": "custom"}], "platforms": ["32-bit Systems", "x64-based Systems"]}, {"vendor": "Microsoft", "product": "Windows 10 Version 1809", "versions": [{"status": "affected", "version": "10.0.17763.0", "lessThan": "10.0.17763.8511", "versionType": "custom"}], "platforms": ["32-bit Systems", "x64-based Systems"]}, {"vendor": "Microsoft", "product": "Windows 10 Version 21H2", "versions": [{"status": "affected", "version": "10.0.19044.0", "lessThan": "10.0.19044.7058", "versionType": "custom"}], "platforms": ["32-bit Systems", "ARM64-based Systems", "x64-based Systems"]}, {"vendor": "Microsoft", "product": "Windows 10 Version 22H2", "versions": [{"status": "affected", "version": "10.0.19045.0", "lessThan": "10.0.19045.7058", "versionType": "custom"}], "platforms": ["32-bit Systems", "ARM64-based Systems", "x64-based Systems"]}, {"vendor": "Microsoft", "product": "Windows 11 version 22H3", "versions": [{"status": "affected", "version": "10.0.22631.0", "lessThan": "10.0.22631.6783", "versionType": "custom"}], "platforms": ["ARM64-based Systems"]}, {"vendor": "Microsoft", "product": "Windows 11 Version 23H2", "versions": [{"status": "affected", "version": "10.0.22631.0", "lessThan": "10.0.22631.6783", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Windows 11 Version 24H2", "versions": [{"status": "affected", "version": "10.0.26100.0", "lessThan": "10.0.26100.8037", "versionType": "custom"}], "platforms": ["ARM64-based Systems", "x64-based Systems"]}, {"vendor": "Microsoft", "product": "Windows 11 Version 25H2", "versions": [{"status": "affected", "version": "10.0.26200.0", "lessThan": "10.0.26200.8037", "versionType": "custom"}], "platforms": ["ARM64-based Systems", "x64-based Systems"]}, {"vendor": "Microsoft", "product": "Windows 11 version 26H1", "versions": [{"status": "affected", "version": "10.0.28000.0", "lessThan": "10.0.28000.1719", "versionType": "custom"}], "platforms": ["ARM64-based Systems", "x64-based Systems"]}], "datePublic": "2026-03-10T14:00:00.000Z", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24282", "name": "Push message Routing Service Elevation of Privilege Vulnerability", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en-US", "value": "Out-of-bounds read in Push Message Routing Service allows an authorized attacker to disclose information locally."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_11_26H1:*:*:*:*:*:*:arm64:*", "vulnerable": true, "versionEndExcluding": "10.0.28000.1719", "versionStartIncluding": "10.0.28000.0"}, {"criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*", "vulnerable": true, "versionEndExcluding": "10.0.17763.8511", "versionStartIncluding": "10.0.17763.0"}, {"criteria": "cpe:2.3:o:microsoft:windows_10_21H2:*:*:*:*:*:*:x86:*", "vulnerable": true, "versionEndExcluding": "10.0.19044.7058", "versionStartIncluding": "10.0.19044.0"}, {"criteria": "cpe:2.3:o:microsoft:windows_10_22H2:*:*:*:*:*:*:x64:*", "vulnerable": true, "versionEndExcluding": "10.0.19045.7058", "versionStartIncluding": "10.0.19045.0"}, {"criteria": "cpe:2.3:o:microsoft:windows_11_25H2:*:*:*:*:*:*:arm64:*", "vulnerable": true, "versionEndExcluding": "10.0.26200.8037", "versionStartIncluding": "10.0.26200.0"}, {"criteria": "cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:arm64:*", "vulnerable": true, "versionEndExcluding": "10.0.22631.6783", "versionStartIncluding": "10.0.22631.0"}, {"criteria": "cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:x64:*", "vulnerable": true, "versionEndExcluding": "10.0.22631.6783", "versionStartIncluding": "10.0.22631.0"}, {"criteria": "cpe:2.3:o:microsoft:windows_11_24H2:*:*:*:*:*:*:arm64:*", "vulnerable": true, "versionEndExcluding": "10.0.26100.8037", "versionStartIncluding": "10.0.26100.0"}, {"criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*", "vulnerable": true, "versionEndExcluding": "10.0.14393.8957", "versionStartIncluding": "10.0.14393.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-06-19T18:17:26.147Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24282", "state": "PUBLISHED", "dateUpdated": "2026-06-19T18:17:26.147Z", "dateReserved": "2026-01-21T21:28:02.967Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2026-03-10T17:04:39.143Z", "assignerShortName": "microsoft"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"platforms": ["32-bit Systems", "x64-based Systems"], "product": "Windows 10 Version 1607", "vendor": "Microsoft", "versions": [{"lessThan": "10.0.14393.8957", "status": "affected", "version": "10.0.14393.0", "versionType": "custom"}]}, {"platforms": ["32-bit Systems", "x64-based Systems"], "product": "Windows 10 Version 1809", "vendor": "Microsoft", "versions": [{"lessThan": "10.0.17763.8511", "status": "affected", "version": "10.0.17763.0", "versionType": "custom"}]}, {"platforms": ["32-bit Systems", "ARM64-based Systems", "x64-based Systems"], "product": "Windows 10 Version 21H2", "vendor": "Microsoft", "versions": [{"lessThan": "10.0.19044.7058", "status": "affected", "version": "10.0.19044.0", "versionType": "custom"}]}, {"platforms": ["32-bit Systems", "ARM64-based Systems", "x64-based Systems"], "product": "Windows 10 Version 22H2", "vendor": "Microsoft", "versions": [{"lessThan": "10.0.19045.7058", "status": "affected", "version": "10.0.19045.0", "versionType": "custom"}]}, {"platforms": ["ARM64-based Systems"], "product": "Windows 11 version 22H3", "vendor": "Microsoft", "versions": [{"lessThan": "10.0.22631.6783", "status": "affected", "version": "10.0.22631.0", "versionType": "custom"}]}, {"platforms": ["x64-based Systems"], "product": "Windows 11 Version 23H2", "vendor": "Microsoft", "versions": [{"lessThan": "10.0.22631.6783", "status": "affected", "version": "10.0.22631.0", "versionType": "custom"}]}, {"platforms": ["ARM64-based Systems", "x64-based Systems"], "product": "Windows 11 Version 24H2", "vendor": "Microsoft", "versions": [{"lessThan": "10.0.26100.8037", "status": "affected", "version": "10.0.26100.0", "versionType": "custom"}]}, {"platforms": ["ARM64-based Systems", "x64-based Systems"], "product": "Windows 11 Version 25H2", "vendor": "Microsoft", "versions": [{"lessThan": "10.0.26200.8037", "status": "affected", "version": "10.0.26200.0", "versionType": "custom"}]}, {"platforms": ["ARM64-based Systems", "x64-based Systems"], "product": "Windows 11 version 26H1", "vendor": "Microsoft", "versions": [{"lessThan": "10.0.28000.1719", "status": "affected", "version": "10.0.28000.0", "versionType": "custom"}]}], "source": "secure@microsoft.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*", "matchCriteriaId": "5AA53525-2EE3-4815-9EEB-49572C16AFC1", "versionEndExcluding": "10.0.14393.8957", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*", "matchCriteriaId": "CB112C3D-A9C8-41A3-A3DD-ACB42387D087", "versionEndExcluding": "10.0.14393.8957", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*", "matchCriteriaId": "B2DCF6CD-BA92-4DB2-855E-DE8158AC6B57", "versionEndExcluding": "10.0.17763.8511", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*", "matchCriteriaId": "40D953EB-E3B1-471A-8400-957984A092EB", "versionEndExcluding": "10.0.17763.8511", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*", "matchCriteriaId": "35CA4CA1-5EDE-4612-9C17-9AA167F773B9", "versionEndExcluding": "10.0.19044.7058", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*", "matchCriteriaId": "C18770C8-2B7F-4212-8A4F-1101ABFF4C44", "versionEndExcluding": "10.0.19044.7058", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*", "matchCriteriaId": "DD070C42-5A71-4D20-B9BA-766565DFC99B", "versionEndExcluding": "10.0.19044.7058", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*", "matchCriteriaId": "17DCF9E0-A09A-48A3-B281-D22EE76B8062", "versionEndExcluding": "10.0.19045.7058", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*", "matchCriteriaId": "51FF473A-566D-45FB-868D-03F3907E094A", "versionEndExcluding": "10.0.19045.7058", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*", "matchCriteriaId": "5FC02001-58B6-4EE4-9552-003F2412ED0C", "versionEndExcluding": "10.0.19045.7058", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*", "matchCriteriaId": "E8B076BC-42F9-4972-BE73-3874E694CD3A", "versionEndExcluding": "10.0.22631.6783", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*", "matchCriteriaId": "6E98A971-B530-4289-B7B2-8403BD2DAD07", "versionEndExcluding": "10.0.22631.6783", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*", "matchCriteriaId": "3381C469-C150-4724-8A53-E11794797D9F", "versionEndExcluding": "10.0.26100.7979", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*", "matchCriteriaId": "6F1A77F2-59BC-4F92-81A0-2A4E8981FEFB", "versionEndExcluding": "10.0.26100.7979", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:*", "matchCriteriaId": "58F3AA3B-9960-48F9-B013-8CF6BA09893C", "versionEndExcluding": "10.0.26200.7979", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:*", "matchCriteriaId": "F113DAFC-91E5-42C1-A2C3-B9C9286D240B", "versionEndExcluding": "10.0.26200.7979", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:*", "matchCriteriaId": "30606CC6-21D2-4EAC-B568-DABA2786EC61", "versionEndExcluding": "10.0.28000.1719", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:*", "matchCriteriaId": "62E818F7-1053-4CD2-9CCE-EF84D3FA7861", "versionEndExcluding": "10.0.28000.1719", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Out-of-bounds read in Push Message Routing Service allows an authorized attacker to disclose information locally."}, {"lang": "es", "value": "Lectura fuera de l\u00edmites en el Servicio de Enrutamiento de Mensajes Push permite a un atacante autorizado divulgar informaci\u00f3n localmente."}], "id": "CVE-2026-24282", "lastModified": "2026-06-17T10:22:49.550", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "secure@microsoft.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24282", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-12T14:27:00.509817Z", "version": "2.0.3"}}]}, "published": "2026-03-10T18:18:17.943", "references": [{"source": "secure@microsoft.com", "tags": ["Vendor Advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24282"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "secure@microsoft.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["32-bit_systems", "x64-based_systems"], "status": "affected", "versions": {"scheme": "generic", "value": "[10.0.14393.0,10.0.14393.8957)"}}], "enrichment": {"confidence": 86.0, "confidence_source": "matching", "scores": [{"score": 86.0, "source": "matching"}]}, "original": {"product": "Windows 10 Version 1607", "source": "cna", "vendor": "Microsoft"}, "product": "windows_10_1607", "vendor": "microsoft"}, {"configurations": [{"platform": ["32-bit_systems", "x64-based_systems"], "status": "affected", "versions": {"scheme": "generic", "value": "[10.0.17763.0,10.0.17763.8511)"}}], "enrichment": {"confidence": 86.0, "confidence_source": "matching", "scores": [{"score": 86.0, "source": "matching"}]}, "original": {"product": "Windows 10 Version 1809", "source": "cna", "vendor": "Microsoft"}, "product": "windows_10_1809", "vendor": "microsoft"}, {"configurations": [{"platform": ["32-bit_systems", "arm64-based_systems", "x64-based_systems"], "status": "affected", "versions": {"scheme": "generic", "value": "[10.0.19044.0,10.0.19044.7058)"}}], "enrichment": {"confidence": 86.0, "confidence_source": "matching", "scores": [{"score": 86.0, "source": "matching"}]}, "original": {"product": "Windows 10 Version 21H2", "source": "cna", "vendor": "Microsoft"}, "product": "windows_10_21h2", "vendor": "microsoft"}, {"configurations": [{"platform": ["32-bit_systems", "arm64-based_systems", "x64-based_systems"], "status": "affected", "versions": {"scheme": "generic", "value": "[10.0.19045.0,10.0.19045.7058)"}}], "enrichment": {"confidence": 86.0, "confidence_source": "matching", "scores": [{"score": 86.0, "source": "matching"}]}, "original": {"product": "Windows 10 Version 22H2", "source": "cna", "vendor": "Microsoft"}, "product": "windows_10_22h2", "vendor": "microsoft"}, {"configurations": [{"platform": ["arm64-based_systems"], "status": "affected", "versions": {"scheme": "generic", "value": "[10.0.22631.0,10.0.22631.6783)"}}], "enrichment": {"confidence": 86.0, "confidence_source": "matching", "scores": [{"score": 86.0, "source": "matching"}]}, "original": {"product": "Windows 11 version 22H3", "source": "cna", "vendor": "Microsoft"}, "product": "windows_11_22h3", "vendor": "microsoft"}, {"configurations": [{"platform": ["x64-based_systems"], "status": "affected", "versions": {"scheme": "generic", "value": "[10.0.22631.0,10.0.22631.6783)"}}], "enrichment": {"confidence": 86.0, "confidence_source": "matching", "scores": [{"score": 86.0, "source": "matching"}]}, "original": {"product": "Windows 11 Version 23H2", "source": "cna", "vendor": "Microsoft"}, "product": "windows_11_23h2", "vendor": "microsoft"}, {"configurations": [{"platform": ["arm64-based_systems", "x64-based_systems"], "status": "affected", "versions": {"scheme": "generic", "value": "[10.0.26100.0,10.0.26100.8037)"}}], "enrichment": {"confidence": 86.0, "confidence_source": "matching", "scores": [{"score": 86.0, "source": "matching"}]}, "original": {"product": "Windows 11 Version 24H2", "source": "cna", "vendor": "Microsoft"}, "product": "windows_11_24h2", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[10.0.26200.0,10.0.26200.8037)"}}], "enrichment": {"confidence": 86.0, "confidence_source": "matching", "scores": [{"score": 86.0, "source": "matching"}]}, "original": {"product": "Windows 11 Version 25H2", "source": "cna", "vendor": "Microsoft"}, "product": "windows_11_25h2", "vendor": "microsoft"}, {"configurations": [{"platform": ["arm64-based_systems"], "status": "affected", "versions": {"scheme": "generic", "value": "[10.0.28000.0,10.0.28000.1719)"}}], "enrichment": {"confidence": 86.0, "confidence_source": "matching", "scores": [{"score": 86.0, "source": "matching"}]}, "original": {"product": "Windows 11 version 26H1", "source": "cna", "vendor": "Microsoft"}, "product": "windows_11_26h1", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[10.0.28000.0,10.0.28000.1719)"}}], "enrichment": {"confidence": 86.0, "confidence_source": "matching", "scores": [{"score": 86.0, "source": "matching"}]}, "original": {"product": "Windows 11 Version 26H1", "source": "cna", "vendor": "Microsoft"}, "product": "windows_11_26h1", "vendor": "microsoft"}], "analysis": {"en": {"generated_at": "2026-03-28T05:07:46.851619+00:00", "value": {"mitigation_remediation": ["Verify whether the system is running an affected Windows 10 or Windows 11 build listed above.", "Download and install the cumulative update that addresses CVE\u20112026\u201124282 from the Microsoft Update Catalog.", "Restart the computer to ensure the update is applied and the Push Message Routing Service restarts.", "Confirm that the service operates normally and no unauthorized scripts or processes attempt to read memory."], "summary": {"action": "Patch Now", "impact": "Local Information Disclosure"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2, as well as Windows 11 versions 22H3, 23H2, 24H2, 25H2, and 26H1. Each of these builds is listed in the CNA affected\u2011version data and matches the corresponding CPE entries.", "description_and_impact": "An out\u2011of\u2011bounds read occurs in Windows' Push Message Routing Service, allowing an authorized attacker to read data beyond the expected buffer. The flaw can expose sensitive information that resides in memory, such as credentials, cryptographic material, or other confidential data. The CVE description does not indicate code execution or privilege escalation; it solely describes local information disclosure.", "risk_and_exploitability": "The CVSS score of 5.5 classifies the severity as moderate. The EPSS score of less than 1% suggests that widespread exploitation is unlikely under normal conditions. The flaw is not included in the CISA KEV catalog, indicating no public exploitation has been documented. Based on the description, it is inferred that the attack vector is local, meaning that an attacker must already have local access to the target system to exploit the read. This limits the threat to users with local authority, but the ability to read arbitrary memory can aid in future attacks if additional information is gathered."}}}}, "created": "2026-03-11T11:46:48.000228+00:00", "updated": "2026-03-29T20:26:32.525085+00:00", "vendors": ["microsoft", "microsoft$PRODUCT$windows_10_1607", "microsoft$PRODUCT$windows_10_1809", "microsoft$PRODUCT$windows_10_21h2", "microsoft$PRODUCT$windows_10_22h2", "microsoft$PRODUCT$windows_11_22h3", "microsoft$PRODUCT$windows_11_23h2", "microsoft$PRODUCT$windows_11_24h2", "microsoft$PRODUCT$windows_11_25h2", "microsoft$PRODUCT$windows_11_26h1"]}