CVE-2026-50367
Microsoft Windows 10 21H2 ≤ 10.0.19044.7548
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2026-50367 is a high-severity Range Error (CWE-118) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 15th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-43952
Vulnerability Data
Incorrect access of indexable resource ('range error') in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover instances where untrusted data is turned into a pointer and dereferenced.
Input validation directly stops out-of-bounds indices from being used on memory, arrays, or files.
Engineering principles such as bounds checking and safe pointer arithmetic stop range errors from being introduced in code.
Process isolation confines damage from an out-of-bounds access to a single domain without preventing the indexing flaw.
Memory protection limits the blast radius of a successful range error but does not stop the incorrect access itself.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce bounds checking and input validation that prevent range errors.
Runtime monitoring can detect adverse events triggered by out-of-bounds accesses but does not prevent them.
Vulnerability identification processes can surface range-error flaws after they exist but do not stop their introduction.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect range errors through fuzzing and boundary-value analysis.
Secure development lifecycle includes input validation and bounds checking that can prevent range errors.
Application security requirements can mandate bounds checking and safe indexing practices.
Secure architecture principles promote defensive coding that limits out-of-bounds access.
Secure coding standards directly require bounds checking and safe array access to prevent range errors.
Information access restriction limits who can access data but does not prevent index-based range errors within allowed access.