Windows Search EoP CVE-2026-50679: public PoC exploit for heap overflow in local privilege escalation
Microsoft patched CVE-2026-50679, a heap-based buffer overflow in the Windows Search component, on July 14, 2026, and rated it CVSS 3.1 7.8 (High) (cve.org). The record describes it as letting an authorized local user elevate privileges, with low privileges required and no user interaction (cve.org). Researcher h4urek has now published full technical details and a proof-of-concept exploit, including exploit source, a payload DLL and a video demo, and reports code execution inside the service (securityonline.info). No exploitation in the wild has been reported, and the CISA ADP SSVC entry in the CVE record lists exploitation as none (cve.org). The public exploit lowers the effort needed for copycat attacks on hosts that have not received the July 2026 updates (securityonline.info).
Entenda a falha
A vulnerabilidade
CVE-2026-50679 is a heap-based buffer overflow in the Windows Search service that gives local privilege escalation (CVSS 3.1 7.8, High). The attacker needs local access and low privileges, with no user interaction. Code running inside the service has far more control than a standard user, because the service runs with high privileges. Affected: Windows 11 24H2 and 25H2 (before 10.0.26100.8875 and 10.0.26200.8875), 26H1 (before 10.0.28000.2525) and Windows Server 2025, including Server Core (before 10.0.26100.33158). Microsoft fixed it in the July 14, 2026 updates.
Como funciona
A search protocol message sent to the Windows Search service carries three strings, each with a length declared by the client. The service copies each string into a buffer whose size is derived from the overall message size. When the declared lengths are larger than what the buffer holds, the copy writes past the end of the heap buffer. That corrupts adjacent heap memory inside the service process.
Por que é vulnerável
The message format does not tie the declared string lengths to the number of bytes actually received, and the service trusts those client-supplied lengths. The buffer is sized from the whole message rather than from the individual declared lengths, so the copy is never bounded correctly. The articles do not describe the exact code change in the fix.
Como foi descoberta
Researcher h4urek published the technical details and exploit, saying they achieved local privilege escalation after a few days of work. According to the article, their report was a duplicate, meaning another researcher found the bug first. Microsoft had already patched it on July 14, 2026, and the write-up came afterwards. No exploitation in the wild has been reported, and CISA's assessment in the CVE record lists exploitation as none.
PoC pública
h4urek published a public repository with exploit source, a payload DLL and a video demo. The exploit sprays query objects, overwrites the function table of one object and redirects execution, then abuses a function in dxcore.dll to load a DLL chosen by the attacker, giving code execution inside the service. It is a working exploit, not just a crash. This lowers the effort for copycat attacks on hosts without the July 2026 updates, so patching is more urgent, especially on servers and multi-user hosts.
Publicada em: securityonline.info/windows-search-cve-2026-50679-poc/ ↗
Explicação gerada por IA a partir da matéria e dos artigos, em 09/11/2026 23:16.
Detalhes técnicos
- Root cause: a malformed search protocol message carries three strings, each with a client-supplied length. The article states that nothing in the message format checks those declared lengths against the bytes actually received (securityonline.info).
- Overflow: the service copies each string into a buffer sized from the overall message, so oversized declared lengths overflow the heap (securityonline.info).
- Exploitation chain: the exploit sprays query objects, overwrites the function table of one object and redirects execution. It then abuses a function in dxcore.dll to load a DLL chosen by the attacker (securityonline.info).
- Prerequisites: the CVSS vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, so local access and low privileges are needed and no user interaction is required (cve.org). The Windows Search service runs with high privileges, which is why code execution inside it gives more control than a standard user has (securityonline.info).
- Discovery: the article says the report was a duplicate, meaning another researcher reported the bug first (securityonline.info).
- Affected builds: 10.0.26100.0 before 10.0.26100.8875 (Windows 11 24H2), 10.0.26200.0 before 10.0.26200.8875 (25H2), 10.0.28000.0 before 10.0.28000.2525 (26H1), and 10.0.26100.0 before 10.0.26100.33158 (Windows Server 2025, including Server Core) (cve.org).
Remediação
- Install Microsoft's July 2026 security updates. The fixed builds are 10.0.26100.8875, 10.0.26200.8875, 10.0.28000.2525 and 10.0.26100.33158 for Server 2025 (cve.org, securityonline.info).
- Monitor the SearchIndexer process for unexpected DLL loads from user-writable folders, as the article suggests (securityonline.info).
- Prioritize servers and shared multi-user hosts, where a local attacker already has a foothold and the public exploit is most useful to them. This is an inference from the local, low-privilege vector, not a vendor statement.
- The research found no GitHub Security Advisory or separate vendor write-up for this flaw; the Microsoft Security Response Center entry is the vendor record cited by cve.org.
Linha do tempo
-
Windows Search EoP CVE-2026-50679: public PoC exploit for heap overflow in local privilege escalation
ler a análise desta fonte ocultar
Microsoft patched CVE-2026-50679, a heap-based buffer overflow in the Windows Search component, on July 14, 2026, and rated it CVSS 3.1 7.8 (High) (cve.org). The record describes it as letting an authorized local user elevate privileges, with low privileges required and no user interaction (cve.org). Researcher h4urek has now published full technical details and a proof-of-concept exploit, including exploit source, a payload DLL and a video demo, and reports code execution inside the service (securityonline.info). No exploitation in the wild has been reported, and the CISA ADP SSVC entry in the CVE record lists exploitation as none (cve.org). The public exploit lowers the effort needed for copycat attacks on hosts that have not received the July 2026 updates (securityonline.info).
Technical Details
- Root cause: a malformed search protocol message carries three strings, each with a client-supplied length. The article states that nothing in the message format checks those declared lengths against the bytes actually received (securityonline.info).
- Overflow: the service copies each string into a buffer sized from the overall message, so oversized declared lengths overflow the heap (securityonline.info).
- Exploitation chain: the exploit sprays query objects, overwrites the function table of one object and redirects execution. It then abuses a function in dxcore.dll to load a DLL chosen by the attacker (securityonline.info).
- Prerequisites: the CVSS vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, so local access and low privileges are needed and no user interaction is required (cve.org). The Windows Search service runs with high privileges, which is why code execution inside it gives more control than a standard user has (securityonline.info).
- Discovery: the article says the report was a duplicate, meaning another researcher reported the bug first (securityonline.info).
- Affected builds: 10.0.26100.0 before 10.0.26100.8875 (Windows 11 24H2), 10.0.26200.0 before 10.0.26200.8875 (25H2), 10.0.28000.0 before 10.0.28000.2525 (26H1), and 10.0.26100.0 before 10.0.26100.33158 (Windows Server 2025, including Server Core) (cve.org).
Remediation
- Install Microsoft's July 2026 security updates. The fixed builds are 10.0.26100.8875, 10.0.26200.8875, 10.0.28000.2525 and 10.0.26100.33158 for Server 2025 (cve.org, securityonline.info).
- Monitor the SearchIndexer process for unexpected DLL loads from user-writable folders, as the article suggests (securityonline.info).
- Prioritize servers and shared multi-user hosts, where a local attacker already has a foothold and the public exploit is most useful to them. This is an inference from the local, low-privilege vector, not a vendor statement.
- The research found no GitHub Security Advisory or separate vendor write-up for this flaw; the Microsoft Security Response Center entry is the vendor record cited by cve.org.