Loading vulnerability…
CVE-2026-50416 is an information disclosure vulnerability in Windows Win32K. The flaw results in exposure of sensitive information to an unauthorized actor and can be exploited by an authorized attacker locally. Specific details about the vulnerable function or code path are not currently available, but the issue affects the Win32K component and permits disclosure of information that should not be accessible to the attacker.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Repository contains a Windows local proof-of-concept suite for CVE-2026-50416, a win32k desktop heap kernel pointer disclosure that bypasses KASLR. The core issue is that any desktop-associated process can read a raw kernel session pool pointer from the user-mode mapped desktop heap at offset 0x100. The main PoC in poc/kaslr_bypass_poc.c demonstrates the full chain: locate the desktop heap via TEB->ClientInfo[5], read the leaked QWORD, validate it as a kernel pointer, derive the kernel desktop heap base by subtracting 0x40, and use user32!gSharedInfo/aheList to compute exact kernel virtual addresses for GUI objects referenced by HWNDs. This is an information disclosure and exploit-enabler, not standalone code execution. Repository structure is straightforward: README.md documents the vulnerability, impact, and exploitation logic; poc/compile.bat builds all binaries with MSVC; and the remaining C files are focused PoCs/supporting demonstrations. kaslr_sandbox_proof.c launches children in multiple security contexts (medium IL, low IL, AppContainer, LPAC, alternate desktop) and shows the same leak persists across sandbox boundaries. supporting_proof_no_window.c proves no window creation is required; merely loading user32 or having a desktop association is sufficient. supporting_proof_no_caps_lpac.c demonstrates the leak from zero-capability AppContainer/LPAC contexts. supporting_proof_remote_trigger.c simulates a browser-renderer-equivalent process to show how a separate renderer RCE could immediately harvest the kernel pointer. supporting_proof_exploitability.c explains how the leak defeats KASLR and enables deterministic targeting of win32k objects in follow-on kernel exploits such as UAF/pool corruption. supporting_proof_sensitive_data.c scans the shared desktop heap for additional cross-process artifacts such as verified window titles and PIDs. There are no external C2 or exploitation network endpoints; this is a local Windows GUI/kernel infoleak PoC suite. The most fingerprintable artifacts are build paths, Visual Studio tooling paths, AppContainer profile names, the Low IL SID S-1-16-4096, and the use of user32.dll/gSharedInfo. Overall maturity is POC: the code is operational for demonstrating the leak and address derivation, but it does not include a privilege-escalation or code-execution payload.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
8 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.