CVE-2026-50372: Windows 10 1607 Privilege Escalation Issue

CVE-2026-50372 Overview

CVE-2026-50372 is a buffer over-read vulnerability in the Windows Redirected Drive Buffering Subsystem (RDBSS). An authorized local attacker can exploit the flaw to elevate privileges on affected Windows client and server platforms. The issue is classified under [CWE-122] (Heap-based Buffer Overflow class) and affects a broad range of supported Windows versions, from Windows 10 1607 through Windows Server 2025. Microsoft published the advisory on July 14, 2026 and rates the flaw HIGH severity with a CVSS v3.1 base score of 7.0. Successful exploitation impacts confidentiality, integrity, and availability.

Critical Impact
A low-privileged local user can trigger a heap buffer over-read in the Redirected Drive Buffering Subsystem to escalate privileges and gain full control over the affected Windows host.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2) across x86, x64, and ARM64 architectures
Microsoft Windows 11 (24H2, 25H2, 26H1) across x64 and ARM64 architectures
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-07-14 - CVE-2026-50372 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-50372

Vulnerability Analysis

The vulnerability resides in the Windows Redirected Drive Buffering Subsystem (RDBSS), a kernel component that mediates buffered I/O between remote file system redirectors and user-mode clients. A buffer over-read occurs when the subsystem reads beyond the boundaries of an allocated heap buffer while processing crafted I/O requests. The over-read exposes adjacent kernel memory contents and, depending on the memory layout, corrupts pointer or object state used by downstream kernel routines. An authorized local attacker leverages this to influence kernel decisions and achieve privilege elevation to SYSTEM. The attack requires local access with low privileges but no user interaction. The high attack complexity reflects the need to shape kernel heap layout reliably before triggering the over-read.

Root Cause

The underlying defect is improper bounds validation on buffer lengths supplied to RDBSS during redirected drive I/O buffering operations. The subsystem trusts a length or offset value that is not fully validated against the actual allocation size, resulting in an out-of-bounds read into adjacent heap memory. Classification under [CWE-122] indicates the affected buffer resides on the kernel heap.

Attack Vector

Exploitation requires local execution on the target system with a valid low-privileged account. The attacker issues crafted I/O control requests against a redirected drive path handled by RDBSS. By grooming the kernel pool prior to the request, the attacker can position sensitive kernel structures adjacent to the vulnerable buffer. The over-read then leaks kernel data used to bypass mitigations such as KASLR, and follow-on manipulation of the corrupted state yields arbitrary kernel read/write primitives that lead to token replacement and full privilege escalation. No verified public proof-of-concept is available at the time of publication, and the vulnerability is not listed on CISA KEV.

Detection Methods for CVE-2026-50372

Indicators of Compromise

Unexpected process token elevation where a low-privileged user process suddenly runs with NT AUTHORITY\SYSTEM context without a legitimate elevation path.
Kernel bugchecks referencing rdbss.sys or related redirector drivers, particularly SYSTEM_SERVICE_EXCEPTION or PAGE_FAULT_IN_NONPAGED_AREA on affected builds.
Anomalous handle acquisitions to redirected drive objects followed by rapid privilege changes in the same session.

Detection Strategies

Monitor Windows Security event ID 4672 (special privileges assigned) for accounts that should not receive administrative privileges.
Correlate Sysmon event ID 10 (process access) targeting lsass.exe from processes launched by standard users shortly after redirected drive activity.
Baseline behavior of rdbss.sys on managed endpoints and alert on new or unsigned kernel modules loaded near RDBSS-related activity.

Monitoring Recommendations

Enable kernel-mode driver load auditing and forward events to a centralized SIEM for correlation across endpoints.
Track EDR telemetry for process token manipulation, parent-child anomalies, and unexpected kernel crashes tied to network redirector paths.
Review authentication and privilege-use logs on servers with mapped or redirected drives, especially multi-user systems such as Remote Desktop Session Hosts.

How to Mitigate CVE-2026-50372

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Advisory for every affected Windows client and server build in the environment.
Prioritize patching multi-user systems, jump hosts, terminal servers, and virtual desktop infrastructure where local attackers are most likely to exist.
Audit local account inventory and remove unnecessary interactive logon rights for standard users on sensitive systems.

Patch Information

Microsoft has released updates addressing CVE-2026-50372 through the standard Windows Update channel. Refer to the Microsoft Security Advisory for build-specific KB numbers covering Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012 through 2025. Confirm patch deployment using Windows Update for Business, WSUS, or Microsoft Configuration Manager compliance reports.

Workarounds

No official vendor workaround has been published; patching is the only supported remediation path.
Restrict local logon rights on high-value systems and enforce least-privilege standards to reduce the pool of accounts capable of triggering the flaw.
Where feasible, disable or limit use of redirected drives in Remote Desktop sessions via Group Policy under Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Device and Resource Redirection.

bash

# Configuration example: verify installed updates on a Windows host
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20

# Check running kernel driver version for rdbss.sys
Get-Item C:\Windows\System32\drivers\rdbss.sys | Select-Object VersionInfo