MSRC-CVE-2026-24282 — Push message Routing Service Elevation of Privilege Vulnerability

Summary

Impact: Information Disclosure. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What type of information could be disclosed by this vulnerability?
An attacker who successfully exploited this vulnerability could potentially read portions of heap memory.

Security updates
10.0.28000.1719 — https://support.microsoft.com/help/5079466
10.0.17763.8511 — https://support.microsoft.com/help/5078752
10.0.19044.7058 — https://support.microsoft.com/help/5078885
10.0.26200.8037 — https://support.microsoft.com/help/5079473
10.0.26200.7979 — https://support.microsoft.com/help/5079420
10.0.22631.6783 — https://support.microsoft.com/help/5078883
10.0.14393.8957 — https://support.microsoft.com/help/5078938

Vulnerabilities 1

Medium 5.5

CVE-2026-24282

Push message Routing Service Elevation of Privilege Vulnerability

Out-of-bounds read in Push Message Routing Service allows an authorized attacker to disclose information locally.

Microsoft Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 1607 Windows

Mar 10, 2026

Revision history

2026-03-10 #1
Information published.

References

CVE-2026-24282 Push message Routing Service Elevation of Privilege Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24282
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss