Vulnerability Spotlight: Information disclosure in Windows 10 Kernel

Summary: Marcin Towalski of Cisco Talos discovered an information disclosure vulnerability in the Windows 10 kernel that an attacker can trigger by tricking a victim into opening a specially crafted executable, causing an out-of-bounds read that discloses sensitive information. Microsoft disclosed and patched the bug as part of its monthly security update Tuesday, and Cisco Talos published Snort rules 53257 and 53258.
Bottom line: The flaw requires a user to execute a crafted file, so the patch Microsoft shipped on Tuesday only closes the hole on systems where it is actually applied - and the sensitive data exposed comes straight out of the kernel.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026