Windows Kernel CVE-2026-35420

Exploitation requires the attacker to already have authenticated, low-privileged local access to the affected Windows Server (CVSS PR:L, AV:L) and the ability to execute code on the host that reaches the vulnerable kernel code path. No user interaction is required (UI:N) and complexity is low (AC:L). What limits exploitation is the strictly local vector: it cannot be triggered remotely or over the network, cannot be automated at scale (SSVC Automatable: no), and demands prior code execution on the machine - making shared/multi-user servers (RDP, terminal, Citrix, jump hosts) the realistic exposure and single-administrator servers far lower risk. Only the enumerated Windows Server builds below the listed fixed versions are affected.

The signals are internally consistent and point to a genuine but not urgent priority. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires local access and existing low-level privileges, with no user interaction and low complexity; impact is high across confidentiality, integrity, and availability, yielding 7.8 (High). EPSS is very low at 0.04% (13th percentile), and CISA SSVC records Exploitation: none and Automatable: no, but Technical Impact: total - meaning that IF exploited the attacker gains full kernel control, but there is no evidence of active or scalable exploitation. No KEV listing and no POC are reported, so this is 'no public exploit identified at time of analysis.' The low EPSS and 'not automatable' rating align well with a local EoP that cannot be triggered remotely or at scale. This is a standard second-stage privilege-escalation primitive: important to patch on multi-user, RDP, or terminal-server hosts where untrusted users have local access, but lower priority on single-admin systems. No signals appear conflicting; the main caveat is that all data originates from Microsoft/NVD/EUVD with no independent third-party corroboration of exploitability.

An attacker who has already gained a low-privileged foothold on a Windows Server - for instance a standard user on a shared RDP/terminal server, or a service account compromised through a separate initial-access bug - runs a crafted program that triggers the kernel heap overflow. By corrupting adjacent kernel heap structures, they overwrite privilege or pointer data to execute code as SYSTEM, completing a full local privilege escalation. No public exploit is identified at time of analysis, so an attacker would need to develop their own reliable heap-grooming technique.