Microsoft’s July Patch Closes a Local Data Leak in Windows Graphics—Check Your Build Number

Microsoft’s July 14, 2026 Patch Tuesday seals a local information-disclosure vulnerability in the Windows Graphics Component that could allow an attacker to read sensitive data from unpatched PCs and servers. The bug, tagged CVE-2026-50483, isn’t being actively exploited, and no exploit code is public. But because it carries a high potential for data exposure even with a moderate 5.5 CVSS score, security teams and everyday users alike should move quickly to verify that the right cumulative updates are installed.

The fix arrives via standard monthly updates—no out-of-band emergency needed—but a few details, including a temporary compatibility hold on certain Dell machines, mean that simply approving the patch isn’t enough. You’ll want to check the actual OS build number to be sure.

A Closer Look at the Graphics Leak

CVE-2026-50483 exists in the Microsoft Graphics Component, a part of Windows that handles rendering, display, and GPU-related tasks across both client and server editions. Microsoft classifies the weakness as an information-disclosure vulnerability, meaning someone who already has a foothold on the machine could coax the graphics subsystem into handing over data that should be off-limits.

According to Microsoft’s Security Update Guide, an attacker needs local access to the device and low-privilege rights—the kind a standard user account or a compromised application might have. There’s no requirement for user interaction: the attack can unfold without anyone opening a file, clicking a link, or approving a prompt. Exploitation complexity is rated low.

The CVSS 3.1 vector string is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. In plain terms:

• The attack is local only.
• No special conditions are required to pull it off.
• The impact is purely on confidentiality, and that impact is rated high.

Microsoft hasn’t publicly shared which specific data an attacker could read. The vulnerability’s root cause—whether it’s an uninitialized memory read, an out-of-bounds access, or something else—is also undisclosed. The CVE simply maps to CWE-200, “Exposure of Sensitive Information to an Unauthorized Actor.” That broad bucket means defenders can’t craft precise detection rules based on the flaw’s technical mechanics. The cumulative update is the only reliable shield.

Which Versions of Windows Are in the Crosshairs

The affected list is limited to newer Windows releases. Microsoft confirms that Windows 10, Windows 11 version 23H2, and older Windows Server editions are not in scope. Here’s what’s vulnerable:

• Windows 11 version 24H2 (x64 and Arm64)
• Windows 11 version 25H2 (x64 and Arm64)
• Windows 11 version 26H1 (x64 and Arm64)
• Windows Server 2025 (x64, including Server Core)

Each product has a specific build-number threshold. If your device is at or above the fixed build, you’re protected. The table below lines up the affected build ranges with the July cumulative update that brings the fix.

KB5101650 is the cumulative update for both Windows 11 24H2 and 25H2, advancing them to builds 26100.8875 and 26200.8875 respectively. Windows 11 26H1 moves to build 28000.2525 via KB5101649. Windows Server 2025, whether it runs the full desktop experience or Server Core, gets KB5099536 and lands on build 26100.33158.

Why a 5.5 Bug Still Matters

At first glance, a 5.5-severity issue that demands local access might seem like a low-priority item. After all, remote-code-execution vulnerabilities tend to grab the headlines. But CVE-2026-50483 deserves attention for two reasons.

First, the high confidentiality impact is not to be dismissed. Although Microsoft hasn’t detailed what information could leak, the CVSS rating suggests it’s more than trivial. Attackers often chain such disclosure bugs with other weaknesses to escalate privileges or pivot across a network. An initial low-privilege foothold might be all an adversary needs to read memory contents that expose credentials, token handles, or kernel pointers, making follow-on attacks far easier.

Second, the affected product list includes platforms where multiple users or workloads share the same hardware. Remote Desktop Session Host servers, virtual desktop infrastructure, shared workstations, and developer boxes all amplify the risk profile. A single unpatched machine that multiple people log into puts more data within reach of a local attacker. Server Core enters the fray because the vulnerable graphics component is present even when the graphical shell is stripped away.

What Home Users Should Do

For most people running Windows 11 at home, the fix will arrive automatically through Windows Update. If you haven’t already restarted after the July patches, doing so is the simplest way to apply the update. To verify:

1. Open Settings > System > About and look for “OS build.”
2. Compare your build number against the fixed thresholds in the table above.
3. If you’re below the fixed build, run Windows Update and install any available updates, then restart.

A quick way to check from the command line or PowerShell is to run winver. The dialog that appears will show the version and build number.

What IT Administrators Must Verify

Patch management teams should treat CVE-2026-50483 as a standard high-priority update within the July 14 release. The absence of active exploitation gives you a normal change window, but waiting weeks on critical servers is ill-advised.

Start by auditing your fleet for build compliance. A PowerShell script like this can pull the necessary info:

Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, OsBuildNumber

Cross-reference the results with the fixed build thresholds. Devices lingering on older builds—even if they “approved” the update—may not have restarted or might be stuck behind a safeguard hold.

The Dell Compatibility Hold

One known complication: Microsoft has temporarily blocked KB5101650 on a limited set of Dell PCs equipped with select Intel processors. Reports indicate unexpected shutdowns, performance degradation, excessive heat, and battery drain on affected models. If you manage Dell hardware, check whether any devices are missing the update due to this hold. Microsoft and Dell are working on a resolution, but forcing the update without testing could destabilize the machines. Instead, inventory the affected endpoints and monitor for a revised driver or updated cumulative patch.

Windows Server 2025 deployments are not impacted by the Dell hold, but they still need KB5099536. Confirm that your Windows Server Update Services (WSUS), Microsoft Intune, or Configuration Manager repositories have the update approved, and pay special attention to Server Core instances that might not appear in a conventional desktop inventory.

Shared-System Scrutiny

Put extra emphasis on any system that supports multiple users or processes untrusted content. Multi-session Windows Servers, VDI hosts, and kiosk-style machines are logical targets for an attacker armed with a low-privilege account and a local info-disclosure bug. Until these systems surpass the fixed build boundary, the risk remains.

How We Got Here

CVE-2026-50483 is part of Microsoft’s regular July 2026 security release, which covers dozens of vulnerabilities across the Windows ecosystem. The flaw was not publicly disclosed before Patch Tuesday, and the Microsoft Security Response Center says it is unaware of any active exploitation. The initial assessment rates future exploitation as “less likely,” though that’s a snapshot from July 14 and not a guarantee.

The Windows Graphics Component has been a recurring source of security concerns. Over the years, bugs in font parsing, image rendering, and GPU drivers have provided attackers with both remote-code-execution and information-disclosure opportunities. This latest entry continues that pattern, albeit one restricted to local access. Its presence in the newest Windows releases underlines that even the latest kernel and graphics stack require continuous hardening.

What to Watch Next

Keep an eye on the MSRC advisory page for CVE-2026-50483 (the reference link below) for any updates on exploitation activity or revised security guidance. If Microsoft later elevates the exploitability assessment or releases additional detection documentation, your patch priority might shift from standard to urgent.

For now, the path forward is clear: get those cumulative updates installed, reboot where required, and verify the build number. The fix itself is straightforward. The real challenge is making sure nothing—not a missed restart, a tucked-away Server Core, or a Dell compatibility hold—leaves a machine exposed.