Windows Kerberos CVE-2026-108132

Exploitation requires the attacker to already hold authenticated low-privileged (PR:L) local code-execution on the target Windows system - there is no remote or network vector (AV:L). The attacker must trigger a double-free (CWE-415) in the Windows Kerberos component, which per AC:H depends on winning a race condition or achieving a specific memory/timing state that is not reliably reproducible, limiting weaponization. No user interaction is needed (UI:N). The flaw affects default installations of all listed Windows 10/11 and Windows Server 2016-2025 builds below the patched versions, so no special non-default configuration is required beyond standard Kerberos presence; the main limiting factors are the prerequisite local foothold and the high attack complexity.

This is a genuine but moderate-priority local privilege escalation issue, not a drop-everything remote threat. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U) confirms the attacker must already have authenticated low-privileged code execution on the host and must win a race or meet specific timing/state conditions (AC:H), which materially lowers reliability of exploitation despite the full C:H/I:H/A:H impact that yields the 7.0 (High) base score. No EPSS probability is provided in the input, there is no CISA KEV listing, and no public POC is referenced, so all three exploitation-likelihood signals are either absent or negative - meaning there is currently no evidence of real-world or widespread exploitation. The primary signals in favor of prioritization are the ubiquity of Windows Kerberos and the clean double-free (CWE-415) memory-corruption primitive, which skilled attackers can weaponize for SYSTEM-level escalation as a post-compromise step. Note a metadata conflict: the input Tags label this 'Information Disclosure', but both the description ('elevate privileges locally') and the CVSS impact set indicate an elevation-of-privilege flaw - treat the tag as unreliable and the EoP classification as authoritative. Bottom line: patch on a normal-to-expedited cycle (it is a local EoP in a core OS component) rather than as an emergency, absent any KEV/EPSS escalation.

An attacker who has already gained low-privileged authenticated access to a Windows host - for example via phishing, a compromised service account, or an initial foothold - runs a crafted program that drives Windows Kerberos into freeing the same memory object twice. By winning the associated race condition (AC:H) and grooming the heap, they corrupt kernel/service memory to execute code at elevated privilege. No public exploit code is identified at the time of analysis, so this would require custom exploit development.