Windows Kernel CVE-2026-50390

Exploitation requires the attacker to already have authenticated local access with low privileges (CVSS PR:L, AV:L) and the ability to execute code on the target - this is a privilege-escalation bug, not a remote entry point, so it is realistically the second stage after an initial compromise. No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning once local code execution is available the type-confusion path is reliably triggerable without special timing or configuration. The scope is unchanged (S:U): impact is confined to the compromised host's kernel, not a separate system. The primary limiting factor is the need for a pre-existing foothold and valid (even unprivileged) local credentials; there is no non-default feature toggle called out in the description, so any unpatched build in the affected list is exploitable by a local low-privileged user.

The signals are internally consistent and point to a genuine but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8 High) shows local attack vector requiring low existing privileges and no user interaction, with total impact - a classic post-compromise privilege-escalation profile rather than an initial-access vector. This aligns with CISA SSVC, which reports Exploitation: none, Automatable: no, and Technical Impact: total, and with the low EPSS score of 0.29% (21st percentile). There is no KEV listing and no POC referenced, so this is not actively exploited and not trivially weaponizable at scale. The main countervailing factor is prevalence: the vulnerable kernel is present in virtually every Windows environment, so while per-host exploitation requires a foothold, the aggregate exposure is large. No signals conflict here - every source agrees this is a locally-exploitable, high-impact EoP that matters most as the second stage of an attack chain.

An attacker who has already obtained low-privileged access to a Windows host - via phishing, a compromised service account, or a separate remote bug - runs a crafted program that triggers the kernel type-confusion condition to corrupt kernel memory and elevate to SYSTEM. With SYSTEM privileges they disable security tooling, harvest credentials, and move laterally. No public exploit is identified at time of analysis, and the local attack vector with low complexity means exploitation is reliable once a foothold exists.