Cyber Resilience

CVE-2026-50485

Memory Safety in Microsoft Windows 10 21H2 ≤ 10.0.19044.7548

Published
14 July 2026
Modified
21 July 2026
Patch / advisory
CVSS Score v3.1 4.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0043 35th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-50485 is a medium-severity Buffer Over-read (CWE-126) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 4.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 35th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

Buffer over-read in Windows Hyper-V allows an authorized attacker to deny service over an adjacent network.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Buffer over-read in Hyper-V directly enables application/system exploitation to crash the service (T1499.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-20846Same product: Microsoft Windows 10 1607
CVE-2026-50445Same product: Microsoft Windows 10 1607
CVE-2026-50504Same product: Microsoft Windows 10 1607
CVE-2026-50341Same product: Microsoft Windows 10 1607
CVE-2026-50475Same product: Microsoft Windows 10 1607
CVE-2025-21277Same product: Microsoft Windows 10 1607
CVE-2026-26155Same product: Microsoft Windows 10 1607
CVE-2026-26169Same product: Microsoft Windows 10 1607
CVE-2026-50435Same product: Microsoft Windows 10 1607
CVE-2026-50402Same product: Microsoft Windows 10 1607

Affected Assets

microsoft
windows 10 1607
≤ 10.0.14393.9339 · ≤ 10.0.14393.9339
microsoft
windows 10 1809
≤ 10.0.17763.9020 · ≤ 10.0.17763.9020
microsoft
windows 10 21h2
≤ 10.0.19044.7548 · ≤ 10.0.19044.7548 · ≤ 10.0.19044.7548
microsoft
windows 10 22h2
≤ 10.0.19045.7548 · ≤ 10.0.19045.7548 · ≤ 10.0.19045.7548
microsoft
windows 11 24h2
≤ 10.0.26100.8875 · ≤ 10.0.26100.8875
microsoft
windows 11 25h2
≤ 10.0.26200.8875 · ≤ 10.0.26200.8875
microsoft
windows 11 26h1
≤ 10.0.28000.2525 · ≤ 10.0.28000.2525
microsoft
windows server 2012
all versions, r2
microsoft
windows server 2016
≤ 10.0.14393.9339
microsoft
windows server 2019
≤ 10.0.17763.9020
+2 more product configuration(s) — see NVD for full list

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure development practices directly prevent introduction of buffer over-read weaknesses.

ID.RA-01 partial match
prevents

Vulnerability identification processes can discover buffer over-read flaws via scanning or review.

PR.PS-02 partial match
prevents

Patching or replacing vulnerable software removes known instances of buffer over-read bugs.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing in development can detect buffer over-reads before release.

prevents

Secure SDLC mandates input validation and bounds checking that can prevent buffer over-reads.

prevents

Application security requirements can specify buffer-size and bounds-checking rules.

prevents

Secure architecture principles include memory-safety and bounds-checking design choices.

prevents

Secure coding standards directly require bounds-checked buffer access, mitigating over-reads.

References