Windows Kernel CVE-2026-50397

Exploitation requires the attacker to already possess local, authenticated access with at least low privileges (PR:L) and the ability to execute code on the target Windows host; there is no network vector and no user interaction is needed (AV:L/UI:N). The key limiting factor is high attack complexity (AC:H): the bug is a use-after-free race condition, so the attacker must reliably win a timing-dependent window to reallocate the freed kernel object with controlled contents, which typically demands multiple attempts and may be sensitive to system load, CPU count, and specific Windows build. The affected code is present in default configurations across all listed Windows 10/11 and Windows Server 2012-2025 editions, so no special feature toggle is required - the constraint is the pre-existing local foothold plus race reliability, not a non-default setting.

The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a local, low-privilege attack requiring high complexity but yielding total system compromise (C:H/I:H/A:H). The high complexity metric is consistent with a use-after-free race that must be won reliably, which meaningfully lowers real-world exploitability compared to a deterministic bug. No EPSS score, KEV listing, SSVC decision, or POC was provided, so exploitation probability cannot be quantified from the input; the absence of KEV means there is no evidence of active exploitation. This profile - needing existing local code execution plus a race win - makes it a credible second-stage privilege escalation for post-compromise chains rather than an internet-facing emergency, but the ubiquity of the affected kernel and full CIA impact justify prompt patching. Note the Tags list 'Denial Of Service' alongside memory corruption, which is consistent with the A:H impact but should be verified against Microsoft's advisory for the definitive impact class.

An attacker who has already gained a foothold as a standard, low-privileged user - for example via phishing, a malicious application, or a compromised service account - runs a local exploit that repeatedly triggers the vulnerable kernel operation to win the use-after-free race, reallocating the freed object with attacker-controlled data. On success the kernel memory corruption is leveraged to escalate to SYSTEM, giving full control of the host. No public exploit is identified at time of analysis, and the high attack complexity means the exploit may require many attempts to succeed reliably.