Cyber Resilience

CVE-2026-50367

Microsoft Windows 10 21H2 ≤ 10.0.19044.7548

Published
14 July 2026
Modified
22 July 2026
Patch / advisory
CVSS Score v3.1 7.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0024 15th percentile
Risk Priority 56 floored blend · peak EPSS

Summary

CVE-2026-50367 is a high-severity Range Error (CWE-118) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 15th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Incorrect access of indexable resource ('range error') in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
T1212 Exploitation for Credential Access Credential Access
Adversaries may exploit software vulnerabilities in an attempt to collect credentials.
T1687 Exploitation for Defense Impairment Defense Impairment
Adversaries may exploit vulnerabilities in security software, infrastructure, or defensive components to degrade, disable, or otherwise continue to impair their ability to prevent, detect, or respond to malicious activity.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-50382Same product: Microsoft Windows 10 1809
CVE-2026-50441Same product: Microsoft Windows 10 1809
CVE-2026-20857Same product: Microsoft Windows 10 1809
CVE-2026-23670Same product: Microsoft Windows 10 1809
CVE-2026-26161Same product: Microsoft Windows 10 1809
CVE-2026-50479Same product: Microsoft Windows 10 1809
CVE-2026-27920Same product: Microsoft Windows 10 1809
CVE-2026-27919Same product: Microsoft Windows 10 1809
CVE-2026-32077Same product: Microsoft Windows 10 1809
CVE-2025-60708Same product: Microsoft Windows 10 1809

Affected Assets

microsoft
windows 10 1809
≤ 10.0.17763.9020 · ≤ 10.0.17763.9020
microsoft
windows 10 21h2
≤ 10.0.19044.7548 · ≤ 10.0.19044.7548 · ≤ 10.0.19044.7548
microsoft
windows 10 22h2
≤ 10.0.19045.7548 · ≤ 10.0.19045.7548 · ≤ 10.0.19045.7548
microsoft
windows 11 24h2
≤ 10.0.26100.8875 · ≤ 10.0.26100.8875
microsoft
windows 11 25h2
≤ 10.0.26200.8875 · ≤ 10.0.26200.8875
microsoft
windows 11 26h1
≤ 10.0.28000.2269 · ≤ 10.0.28000.2525
microsoft
windows server 2019
≤ 10.0.17763.9020
microsoft
windows server 2022
≤ 10.0.20348.5386
microsoft
windows server 2025
≤ 10.0.26100.33158

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

Developer testing and evaluation can discover instances where untrusted data is turned into a pointer and dereferenced.

Input validation directly stops out-of-bounds indices from being used on memory, arrays, or files.

Engineering principles such as bounds checking and safe pointer arithmetic stop range errors from being introduced in code.

Process isolation confines damage from an out-of-bounds access to a single domain without preventing the indexing flaw.

Memory protection limits the blast radius of a successful range error but does not stop the incorrect access itself.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly enforce bounds checking and input validation that prevent range errors.

DE.CM-09 partial match
prevents

Runtime monitoring can detect adverse events triggered by out-of-bounds accesses but does not prevent them.

ID.RA-01 partial match
prevents

Vulnerability identification processes can surface range-error flaws after they exist but do not stop their introduction.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing can detect range errors through fuzzing and boundary-value analysis.

prevents

Secure development lifecycle includes input validation and bounds checking that can prevent range errors.

prevents

Application security requirements can mandate bounds checking and safe indexing practices.

prevents

Secure architecture principles promote defensive coding that limits out-of-bounds access.

prevents

Secure coding standards directly require bounds checking and safe array access to prevent range errors.

none

Information access restriction limits who can access data but does not prevent index-based range errors within allowed access.

References