Windows Kernel CVE-2026-50329

Exploitation requires the attacker to already have local, authenticated code-execution on the target host at low privilege (CVSS PR:L) - this is a second-stage privilege-escalation flaw, not an initial-access or remote vector (AV:L). No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once local code runs the attacker can trigger the kernel use-after-free directly against a default configuration; no special feature toggle or non-default setting is named in the description. The limiting factors are therefore: the attacker must first obtain a foothold that can execute code on the machine, and the target must be an unpatched build of one of the listed Windows 10/11 or Windows Server 2019/2022/2025 SKUs. There is no network-exploitable path and no privilege bypass to gain that initial foothold from this CVE alone.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High) describes a low-complexity local attack requiring only low existing privileges and no user interaction, with high impact across all three security properties - a classic reliable privilege-escalation profile. No EPSS score was provided in the input, so exploitation probability cannot be quantified here; the CVE is not in CISA KEV and no POC is referenced, so there is currently no evidence of active or public exploitation. This is a real defensive priority because kernel EoP bugs are prized second-stage components in malware and post-compromise toolchains (they convert a foothold into SYSTEM), but it is not a remote or wormable network threat - an attacker must already be able to run code on the host. The signals are internally consistent: local vector, prior privileges required, and no exploitation evidence together suggest a patch-on-normal-cadence item that should be prioritized on multi-user, RDP/session-host, and server systems where untrusted local code may run. Absence of EPSS and POC data is a gap, not a clearance - treat as inference from the CVSS vector and Microsoft's own reporting.

An attacker who has already gained low-privileged code execution on a Windows host - for example via phishing, a compromised standard user account, or a foothold on a shared terminal server - runs a crafted program that triggers the kernel use-after-free, grooms the freed allocation, and reclaims it to corrupt kernel memory and elevate to SYSTEM. Given AV:L/AC:L, exploitation is local and low-complexity with no user interaction required, though it depends on the attacker having a working exploit; no public exploit identified at time of analysis.