Windows Kernel CVE-2026-49798

Exploitation requires local code execution on the affected Windows host: per the CVSS vector AV:L, the attacker must be able to run a program on the target (interactively, via RDP, or through an already-running low-privileged process), so this is a post-access privilege-escalation primitive, not a remote entry point. The vector's PR:N/UI:N indicates no additional privileges and no user interaction are needed once local code runs, and AC:L indicates no special timing or configuration is required - the flaw is reachable in default configurations of the listed Windows versions. The primary limiting factor is therefore the local-access precondition: an attacker with no ability to execute code on the machine cannot reach this bug over the network. Affected scope is broad (Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025), so version is not a meaningful limiter among supported SKUs.

This is a genuine high priority for patch prioritization, though not an emergency in the sense of confirmed mass exploitation. The CVSS 3.1 base score of 9.3 with vector AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H reflects local attack vector, low complexity, no required privileges or user interaction, a scope change, and total impact to confidentiality, integrity, and availability. The very high score is driven largely by the S:C (scope change) - a kernel UAF that lets code escape its original security context - combined with maximal impact. There is a notable tension to flag: PR:N (no privileges required) is unusual for a bug described as local privilege escalation, which normally presumes the attacker already has some low-privileged foothold; Microsoft's scoring here treats any local code execution context as the starting point, so treat 'unauthorized' as 'any local user, including low-privileged.' No EPSS score, SSVC decision, or KEV entry was provided; there is no public exploit identified at time of analysis. Local-only vector means this is a post-compromise escalation primitive rather than an initial-access or wormable network flaw, so real-world risk is high in multi-user/hostile-endpoint contexts but requires the attacker to first run code on the host.

An attacker who already has a low-privileged foothold on a Windows host - for example via phishing, a malicious application, or a compromised standard user account - runs a crafted program that drives the vulnerable kernel code path to free an object and then reuse the dangling reference. By grooming kernel memory around the freed allocation, the attacker corrupts kernel structures to overwrite a security token or redirect execution, elevating from standard user to SYSTEM. No public exploit is identified at time of analysis, and the low attack complexity (AC:L) means a working exploit, once developed, would be reliable.