Windows Kernel CVE-2026-50300

Exploitation requires a locally authenticated user account with at minimum low-privilege access on the target system (PR:L per CVSS vector AV:L/AC:L/PR:L/UI:N). The attack is entirely local - no network connectivity to or from the target is required or involved. No user interaction beyond the attacker's own actions is needed (UI:N). Low attack complexity (AC:L) indicates that no race condition, non-default configuration, or special environmental state is required; a standard authenticated local session is sufficient. Exploitation is fundamentally bounded by the requirement for local access: remote or unauthenticated network exploitation is not possible per the confirmed CVSS vector. The specific kernel API, syscall, or driver code path that must be invoked to trigger the underflow is not disclosed in available public data.

The CVSS base score of 5.5 (Medium) accurately reflects the limited attack surface: the vulnerability is local-only (AV:L), requires only a low-privilege account (PR:L), and has no integrity or availability impact. The high confidentiality impact (C:H) is the primary concern, as kernel memory disclosure can serve as a stepping stone in multi-stage privilege escalation chains - leaking KASLR offsets or token values that enable subsequent exploitation. No EPSS score was provided in the available intelligence, so exploitation probability cannot be quantified numerically. KEV status is not confirmed, and no public POC has been identified at time of analysis; these signals together suggest this is currently a patch-priority issue rather than an active incident-response priority. The real-world risk to organizations with strict local access controls (e.g., locked-down VDI, kiosk environments) is further reduced, while environments permitting broad local interactive logon (developer workstations, shared servers) carry higher risk. The absence of network exploitability is the single most significant risk-limiting factor.

A low-privileged user logged into an unpatched Windows system executes a crafted application or script that issues a specific kernel call, triggering the integer underflow in the vulnerable kernel code path. The arithmetic wraparound causes the kernel to copy memory from an unintended address into a user-accessible buffer, leaking kernel pointers or security token values. The attacker uses the disclosed pointers to defeat KASLR and construct a follow-on kernel exploit for full privilege escalation. No public POC has been identified at time of analysis.