Windows Kernel CVE-2026-50478

Exploitation requires the attacker to already have local, authenticated, low-privileged access to the target Windows host (CVSS PR:L, AV:L) - this is a post-compromise elevation primitive, not a remote entry point, so a prior foothold (valid credentials, an existing malware/agent, or another initial-access vulnerability) is the key prerequisite and the primary limiting factor. No user interaction is needed (UI:N) and attack complexity is low (AC:L), meaning once local code execution exists, no special product feature, non-default configuration, or victim action is required to trigger the flaw. The affected platform range is broad (Windows 10/11 and Server 2019-2025), so version-specificity is not a meaningful limiter, though the exact vulnerable build must match the pre-patch KB level.

The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - local attack vector, low complexity, low privileges required, no user interaction, and full confidentiality/integrity/availability impact within an unchanged scope. This is a classic local elevation-of-privilege profile: the attacker must already be running code on the host (PR:L), which is why it is not remotely exploitable, but once that foothold exists the barrier to SYSTEM is low. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified from this data. It is not in CISA KEV and no POC is referenced, so there is no evidence of active or public exploitation. That said, kernel UAF bugs are a favored post-compromise primitive in real intrusions and ransomware tradecraft because they reliably chain with phishing or commodity malware that provides the initial low-privileged foothold; the 'Denial Of Service' tag suggests the bug can also be triggered to crash the kernel (bugcheck) even absent full code execution. Realistic priority is moderate-to-high for patching despite the absence of KEV/POC, given the ubiquity of the platform and the strong impact metrics.

An attacker first obtains ordinary low-privileged code execution on a Windows host - for example via a phishing payload, a compromised standard user account, or a foothold from another exploited application. They then run a crafted program that triggers the kernel use-after-free, grooms the kernel pool to reclaim the freed object with attacker-controlled data, and escalates to SYSTEM to disable security tooling, install persistence, or move laterally. No public POC is referenced, so a working exploit would need to be developed or acquired.