PoC Exploit Published for Windows Search Elevation of Privilege Flaw CVE-2026-50679
Do Son 
TL;DR
Researcher h4urek has published full technical details and a proof-of-concept exploit for CVE-2026-50679, a Windows Search vulnerability that allows local elevation of privilege. Microsoft rated the heap overflow CVSS 7.8 and patched it on July 14, 2026. The public repository now includes exploit source, a payload DLL and a video demo.
A malformed search message makes the Windows Search service copy attacker-sized strings past a heap buffer. The researcher turned this into code execution inside the service. Install Microsoft’s July 2026 updates if you have not already.
- CVE: CVE-2026-50679
- CVSS: 7.8 (High · CVSSv3)
- Product: Microsoft Windows 11 Version 24H2
- Affected: 10.0.26100.0, 10.0.26200.0, 10.0.28000.0
- Impact: Windows Search Service Elevation of Privilege Vulnerability
- Status: No confirmed exploitation yet
- Patched in: 10.0.26100.8875, 10.0.26200.8875, 10.0.28000.2525, 10.0.26100.33158
- EPSS: 0.3% (30-day)
- Action: Update to 10.0.26100.8875, 10.0.26200.8875, 10.0.28000.2525, 10.0.26100.33158 now
Why It Matters
The Windows Search service runs with high privileges, so code running inside it gives an attacker far more control than a normal user has. Now the proof-of-concept exploit is public, which lowers the bar for copycat attacks on unpatched machines. The researcher said they “managed to achieve LPE” after a few days of work. Notably, the report was “a duplicate,” meaning another researcher found the bug first.
So far, no exploitation in the wild has been reported. CISA’s assessment in the CVE record lists exploitation as “none.”
How the Attack Works
One search protocol message carries three strings, each with a length the client supplies. As the write-up explains, “nothing in the message format ties the declared lengths to that number” of bytes received. The service then copies each string into a buffer sized from the overall message, so oversized lengths overflow the heap.
The exploit sprays query objects, overwrites one object’s function table and redirects execution. Finally, it abuses a function in dxcore.dll to load a DLL of the attacker’s choice.
Affected Versions
- Windows 11 24H2, 25H2 and 26H1
- Windows Server 2025, including Server Core
Patch and Mitigation
Apply Microsoft’s July 2026 Patch Tuesday updates to fix this Windows Search vulnerability. Defenders can also watch the SearchIndexer process for unexpected DLL loads from user-writable folders.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
