Improper neutralization of special elements used in a command ('command injection') in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Microsoft | Windows 11 Version 24H2 | affected |
|
||||||
| Microsoft | Windows 11 Version 25H2 | affected |
|
||||||
| Microsoft | Windows Server 2025 | affected |
|
||||||
| Microsoft | Windows Server 2025 (Server Core installation) | affected |
|
No data.
No data.
No data.
Project Subscriptions
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Tue, 14 Jul 2026 17:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Improper neutralization of special elements used in a command ('command injection') in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally. | |
| Title | Clipboard User Service Elevation of Privilege Vulnerability | |
| First Time appeared |
Microsoft
Microsoft windows 11 24h2 Microsoft windows 11 25h2 Microsoft windows Server 2025 |
|
| Weaknesses | CWE-77 | |
| CPEs | cpe:2.3:o:microsoft:windows_11_24H2:*:*:*:*:*:*:arm64:* cpe:2.3:o:microsoft:windows_11_25H2:*:*:*:*:*:*:arm64:* cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:* |
|
| Vendors & Products |
Microsoft
Microsoft windows 11 24h2 Microsoft windows 11 25h2 Microsoft windows Server 2025 |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: microsoft
Published:
Updated: 2026-07-14T18:45:42.384Z
Reserved: 2026-06-04T18:59:53.336Z
Link: CVE-2026-50488
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses