Windows Kernel CVE-2026-50399

Exploitation requires the attacker to already hold local, authenticated low-privilege access (PR:L) with the ability to execute code on the target Windows system - this is a post-compromise privilege-escalation flaw, not an initial-access vector. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once local code execution exists, escalation is straightforward against affected default builds. The primary limiting factor is the local-only attack surface (AV:L): the attacker cannot reach the kernel path over the network and must first land on the host by other means. Affected platforms are limited to the listed builds - Windows 10 21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2022/2025.

This is a credible but not emergency-tier priority. The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a local-only attack vector requiring the attacker to already have low-privilege authenticated code execution on the target - it is not remotely exploitable and cannot be the initial access vector. Mitigating factors: local access required, low complexity but no remote reach. Aggravating factors: no user interaction required, full CIA impact, and the affected component is the kernel across ubiquitously deployed Windows versions, making it a classic second-stage EoP that ransomware and post-exploitation toolkits value. No EPSS score was provided in the input, and there is no KEV listing or public POC identified, so real-world exploitation pressure currently appears low-to-moderate rather than active. One data conflict to flag: CWE-125 (out-of-bounds READ) and the 'Information Disclosure' tag primarily imply confidentiality impact, yet the vector asserts I:H and A:H - verify with Microsoft's advisory whether integrity/availability impact is direct or derived from a chained exploitation technique.

An attacker who has already obtained low-privileged code execution on a Windows host - for example via a phishing payload, a compromised service account, or a foothold on a shared terminal server - runs a crafted local program that invokes the vulnerable kernel path to trigger the out-of-bounds read, leaks kernel memory to defeat address-space protections, and escalates to SYSTEM. No user interaction is required. No public proof-of-concept has been identified at time of analysis, so a working exploit would need to be developed or acquired.