CVE-2026-32215
Sensitive Data Exposure via Log Injection in Windows Kernel
Publication date: 2026-04-14
Last updated on: 2026-04-20
Assigner: Microsoft Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| microsoft | windows_10_1809 | to 10.0.17763.8644 (exc) |
| microsoft | windows_10_1809 | to 10.0.17763.8644 (exc) |
| microsoft | windows_10_21h2 | to 10.0.19044.7184 (exc) |
| microsoft | windows_10_21h2 | to 10.0.19044.7184 (exc) |
| microsoft | windows_10_21h2 | to 10.0.19044.7184 (exc) |
| microsoft | windows_10_22h2 | to 10.0.19045.7184 (exc) |
| microsoft | windows_10_22h2 | to 10.0.19045.7184 (exc) |
| microsoft | windows_10_22h2 | to 10.0.19045.7184 (exc) |
| microsoft | windows_11_23h2 | to 10.0.22631.6936 (exc) |
| microsoft | windows_11_23h2 | to 10.0.22631.6936 (exc) |
| microsoft | windows_11_24h2 | to 10.0.26100.8246 (exc) |
| microsoft | windows_11_24h2 | to 10.0.26100.8246 (exc) |
| microsoft | windows_11_25h2 | to 10.0.26200.8246 (exc) |
| microsoft | windows_11_25h2 | to 10.0.26200.8246 (exc) |
| microsoft | windows_11_26h1 | to 10.0.28000.1836 (exc) |
| microsoft | windows_11_26h1 | to 10.0.28000.1836 (exc) |
| microsoft | windows_server_2019 | to 10.0.17763.8644 (exc) |
| microsoft | windows_server_2022 | to 10.0.20348.5020 (exc) |
| microsoft | windows_server_2022_23h2 | to 10.0.25398.2274 (exc) |
| microsoft | windows_server_2025 | to 10.0.26100.32690 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-532 | The product writes sensitive information to a log file. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the insertion of sensitive information into a log file within the Windows Kernel. It allows an authorized attacker to locally disclose this sensitive information.
How can this vulnerability impact me? :
The vulnerability can lead to information disclosure, where sensitive data is exposed to an authorized attacker on the local system. This could compromise confidentiality without affecting integrity or availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability involves the insertion of sensitive information into log files in the Windows Kernel, which allows an authorized attacker to disclose information locally.
Such unauthorized disclosure of sensitive information could potentially impact compliance with data protection standards and regulations like GDPR and HIPAA, which require the protection of sensitive data and prevention of unauthorized access or disclosure.
However, the provided information does not explicitly detail the specific compliance implications or how organizations should address this vulnerability in the context of these regulations.
What immediate steps should I take to mitigate this vulnerability?
This vulnerability involves insertion of sensitive information into log files in the Windows Kernel, allowing local information disclosure by an authorized attacker.
To mitigate this vulnerability, it is recommended to apply the security updates provided by Microsoft as detailed in their official security update guide.