Researcher publishes Windows Search exploit for CVE-2026-50679

SecurityOnline[.]info reports that researcher h4urek has published full technical details and a proof-of-concept exploit for CVE-2026-50679, a Windows Search elevation of privilege flaw. The draft notes that Microsoft patched the vulnerability on 14 July 2026 and assigns the CVSS v3 base score of 7.8 (High). The public repository accompanying the disclosure allegedly contains the exploit source, a payload DLL and a video demonstration.

The advisory lists affected products as Windows 11 24H2, 25H2 and 26H1, with affected builds 10.0.26100.0, 10.0.26200.0 and 10.0.28000.0, and notes patched versions as 10.0.26100.8875, 10.0.26200.8875, 10.0.28000.2525 and 10.0.26100.33158. The piece states there has been no confirmed exploitation at the time of reporting.

According to the write-up, the attack exploits a heap overflow triggered by a malformed search protocol message containing three client-controlled strings. The Windows Search service copies these strings into a heap-allocated buffer, allowing the attacker to spray query objects, overwrite a function table and redirect code execution, ultimately enabling loading of an attacker-controlled DLL via dxcore.dll.

The article notes that, while there is public PoC material, there has been no detected exploitation in the wild, and CISA’s CVE record classifies exploitation as “none.” The guidance urges applying the July 2026 updates and monitoring the SearchIndexer process for unexpected DLLs loaded from user-writable folders.