Windows Kernel CVE-2026-40408

Exploitation requires the attacker to already have authenticated, low-privileged local code execution on the target Windows system (CVSS PR:L, AV:L) and to run a program that invokes the vulnerable kernel-mode driver code path to trigger the use-after-free; no user interaction is needed (UI:N). Limiting factors: it cannot be triggered remotely or unauthenticated - the attacker needs an existing local foothold and the ability to execute arbitrary code, and reliable exploitation depends on winning a kernel heap-grooming race to reclaim the freed object, which SSVC rates as not automatable. The vulnerable component ships in default installations of all listed Windows builds, so no special feature or non-default configuration is required beyond having a running, unpatched system.

Signals are consistent and point to a genuine but non-urgent local escalation issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, base 7.8 High) requires local access and existing low-level privileges, so this is a post-compromise escalation primitive rather than an initial-access vector. EPSS is very low (0.04%, 13th percentile) and CISA SSVC rates Exploitation as 'none' and Automatable as 'no', while Technical Impact is 'total' - meaning if exploited it grants full control, but no exploitation is currently observed or expected to be easily automated. There is no KEV listing and no public exploit identified at time of analysis. Net: prioritize via normal Patch Tuesday cadence; it is not a drop-everything emergency, but the total technical impact and ubiquitous footprint mean it should not be deferred indefinitely, especially on multi-user or shared hosts where local low-privileged users exist.

An attacker who has already gained a low-privileged foothold on a Windows host - for example through phishing, a compromised service account, or a standard user login on a shared terminal server - runs a crafted program that triggers the use-after-free in the vulnerable kernel-mode driver. By grooming kernel heap memory to reclaim the freed object, they corrupt kernel structures and elevate to SYSTEM, gaining full control of the machine. No public exploit is identified at time of analysis, so this would require attacker-developed tooling.