CVE-2026-32218
Sensitive Data Exposure via Log Injection in Windows Kernel
Publication date: 2026-04-14
Last updated on: 2026-04-20
Assigner: Microsoft Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| microsoft | windows_10_21h2 | to 10.0.19044.7184 (exc) |
| microsoft | windows_10_21h2 | to 10.0.19044.7184 (exc) |
| microsoft | windows_10_21h2 | to 10.0.19044.7184 (exc) |
| microsoft | windows_10_22h2 | to 10.0.19045.7184 (exc) |
| microsoft | windows_10_22h2 | to 10.0.19045.7184 (exc) |
| microsoft | windows_10_22h2 | to 10.0.19045.7184 (exc) |
| microsoft | windows_11_23h2 | to 10.0.22631.6936 (exc) |
| microsoft | windows_11_23h2 | to 10.0.22631.6936 (exc) |
| microsoft | windows_11_24h2 | to 10.0.26100.8246 (exc) |
| microsoft | windows_11_24h2 | to 10.0.26100.8246 (exc) |
| microsoft | windows_11_25h2 | to 10.0.26200.8246 (exc) |
| microsoft | windows_11_25h2 | to 10.0.26200.8246 (exc) |
| microsoft | windows_11_26h1 | to 10.0.28000.1836 (exc) |
| microsoft | windows_11_26h1 | to 10.0.28000.1836 (exc) |
| microsoft | windows_server_2022 | to 10.0.20348.5020 (exc) |
| microsoft | windows_server_2022_23h2 | to 10.0.25398.2274 (exc) |
| microsoft | windows_server_2025 | to 10.0.26100.32690 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-532 | The product writes sensitive information to a log file. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the insertion of sensitive information into a log file within the Windows Kernel. It allows an authorized attacker to locally disclose sensitive information by accessing these log files.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability involves the insertion of sensitive information into log files in the Windows Kernel, which allows an authorized attacker to disclose information locally.
Such unauthorized disclosure of sensitive information could potentially impact compliance with data protection regulations like GDPR and HIPAA, which require the protection of sensitive data and prevention of unauthorized access or disclosure.
However, the provided information does not explicitly state the direct effects on compliance with these standards.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, apply the security updates provided by Microsoft for the Windows Kernel as soon as possible.
Since the vulnerability involves insertion of sensitive information into log files allowing local information disclosure, restricting local access to authorized users and monitoring for unusual local activity can help reduce risk.
How can this vulnerability impact me? :
The vulnerability can lead to information disclosure, where sensitive data is exposed to an authorized attacker on the local system. This could compromise confidentiality by revealing sensitive information that should otherwise be protected.