Windows Kernel CVE-2026-48583

Attacker must already have the ability to execute code as a low-privileged (non-SYSTEM, non-admin) user on the target Windows host - the CVSS vector AV:L/PR:L/UI:N confirms local access plus an authenticated standard-user-class account is required, with no victim user interaction needed. There is no network-reachable attack surface: remote exploitation is not possible without first establishing a local foothold via another vector. The specific kernel component, syscall, or IOCTL that contains the vulnerable allocation is not disclosed in the supplied description, so triggering the UAF requires reverse-engineering the patched kernel binary diff to identify the vulnerable code path. Sandboxed processes (AppContainer, Chromium renderer, Office Protected View) would need to first escape their sandbox to obtain the low-privileged token needed.

Real-world risk is moderate-to-high for multi-user, kiosk, terminal-server, and endpoint environments where local code execution is achievable through phishing, malicious documents, or commodity malware footholds. The CVSS vector AV:L/AC:L/PR:L/UI:N indicates an attacker already needs local access and a low-privileged account, but no user interaction is needed once the attacker can run code - a classic profile for second-stage post-exploitation EoP bugs that ransomware crews and APTs routinely chain. EPSS data was not provided in the input, and the CVE is not on the CISA KEV list per the supplied references, so widespread mass exploitation is not currently indicated. However, kernel UAF EoPs in Windows have historically been weaponized within weeks of patch release (e.g., CVE-2023-28252, CVE-2024-38106), so defenders should not discount this on the basis of absent EPSS/KEV signals alone - that absence may simply reflect the recency of disclosure rather than low real-world risk.

An attacker who has already gained low-privileged code execution on a Windows host - for example via a phished Office macro, a malicious LNK, or a compromised standard-user account on a terminal server - runs a small native binary that repeatedly allocates and frees the vulnerable kernel object, then sprays controlled data into the freed slot to hijack a dangling pointer. The resulting kernel read/write primitive is used to overwrite the EPROCESS token of the attacker's process with a SYSTEM token, after which they install persistence, disable Defender, and move laterally. No public proof-of-concept exploit was identified at time of analysis.