Windows Kernel CVE-2026-108466

Exploitation requires user interaction (UI:R) - the victim must perform some action that routes crafted content to the vulnerable Windows Kernel code path - combined with high attack complexity (AC:H), meaning the attacker must satisfy specific timing or input conditions outside their direct control to trigger the out-of-bounds read. No authentication or prior privileges are needed (PR:N), and the vector is network-reachable (AV:N). The realistic outcome is limited to denial of service (A:H only; C:N/I:N) - no data exposure or code execution. The combination of mandatory user interaction, high complexity, and availability-only impact substantially limits practical exploitation against default Windows deployments.

This is a moderate-severity, availability-only issue that most signals agree is LOW real-world priority. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.3) shows a network-reachable, unauthenticated flaw, but two strong mitigating factors blunt it: high attack complexity (AC:H) and required user interaction (UI:R). Impact is confined to availability (A:H) with no confidentiality or integrity loss (C:N/I:N) - consistent with the description's denial-of-service outcome. CISA's SSVC framework reinforces low urgency: Exploitation=none, Automatable=no, Technical Impact=partial. There is no CISA KEV listing and no public exploit identified, so this is neither actively exploited nor trivially weaponizable. EPSS was not provided in the input, so exploitation probability cannot be quantified here. One notable conflict: the input Tags label this 'Information Disclosure,' yet the CVSS vector sets C:N (no confidentiality impact) and the description states denial of service - the 'Information Disclosure' tag appears mislabeled and should not drive risk decisions. Bottom line: a genuine but low-priority DoS that is hard to exploit (AC:H + UI:R) and non-automatable; patch on normal Patch Tuesday cadence rather than as an emergency.

A remote, unauthenticated attacker lures a user into interacting with specially crafted network content or a malicious resource that reaches the Windows kernel's affected code path. The out-of-bounds read is triggered under specific timing or input conditions (high complexity), causing the kernel to crash and the system to become unavailable. No public exploit code has been identified, and the attack yields denial of service only - no data disclosure or code execution.