Windows Kernel CVE-2026-49167

Exploitation requires the attacker to already have local, authenticated access with the ability to execute code on the target (CVSS PR:L, AV:L) - this is a second-stage privilege-escalation, not a remote entry point. No user interaction is needed (UI:N) and no special product feature or non-default setting must be enabled; the vulnerable code ships in the default Windows Kernel of all listed builds, so any unpatched host below the fixed build is exploitable by a local user. Limiting factors: the attacker must first obtain initial local execution by other means, and exploitation is bounded to the local machine (Scope:Unchanged). Successful use-after-free exploitation may also require pool-grooming reliability, and hosts already updated to the fixed build for their branch are not affected.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High) describes a low-complexity local attack requiring low existing privileges and no user interaction, with total confidentiality/integrity/availability impact on the affected system - consistent with a classic LPE to SYSTEM. Real-world signals temper urgency: EPSS is 0.25% (16th percentile), and CISA SSVC lists Exploitation: none and Automatable: no, while acknowledging Technical Impact: total. There is no KEV listing and no POC identified, so this is a real but not emergency-priority issue - high impact if chained (e.g., after initial access via phishing or a browser exploit) but not remotely reachable on its own. No signals conflict: the local vector and low-EPSS/no-exploitation status align, suggesting a genuine kernel LPE that is patch-worthy but not under active mass exploitation. The primary caveat is that Microsoft MSRC descriptions are terse, so the exact vulnerable component/driver and trigger conditions are not disclosed in the available data.

An attacker who has already gained low-privileged code execution on a Windows host - for example through a phishing payload, a compromised service account, or a browser sandbox escape - runs a crafted local program that triggers the kernel use-after-free and grooms the pool to reclaim the freed object. By controlling the reused allocation they obtain arbitrary kernel read/write and elevate to SYSTEM, then disable security tooling or move laterally. No public POC is identified at time of analysis, and the low attack complexity means a working exploit would be reliable once developed.