Windows Kernel CVE-2026-50484

Exploitation requires the attacker to already have local, authenticated code-execution on the target Windows host (CVSS PR:L, AV:L) - this is a privilege-escalation bug, not a remote entry point, so it must be chained after some initial access such as a phished payload, malicious insider, or a low-privileged service account. No user interaction is needed (UI:N) and attack complexity is low (AC:L), meaning once local access is held the overflow is reliably triggerable against default configurations of the affected Windows Kernel with no special feature toggle noted in the description. The primary limiting factors are the need for prior local access and possession of at least low-level privileges; it cannot be launched remotely or unauthenticated over the network.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U, C:H/I:H/A:H) describes a locally exploitable, low-complexity, low-privilege escalation with full confidentiality/integrity/availability impact - the standard high-value profile for kernel EoP bugs, which are routinely chained after phishing or commodity malware to move from a user context to SYSTEM. No EPSS score, SSVC decision, or KEV status was provided in the input, so exploitation probability cannot be quantified and there is no public exploit identified at time of analysis; the local attack vector meaningfully limits mass, remote, unauthenticated abuse. The realistic priority driver here is not raw scores but ubiquity: this affects nearly every supported Windows build, so despite the 'only' 7.8 rating it should be patched promptly, particularly on multi-user, RDP, and server hosts where any foothold is one step from full compromise. Note the absence of EPSS/KEV data is a gap - treat exploitation likelihood as unknown, not zero.

An attacker who has already obtained a low-privileged foothold - for example through a phishing payload or stolen standard-user credentials - runs a crafted program that triggers the heap overflow in the vulnerable kernel routine, corrupting adjacent pool memory to hijack kernel execution and elevate to SYSTEM. From there they disable security tooling, harvest credentials, and pivot laterally. No public exploit is identified at time of analysis, and the local attack vector (AV:L) means the attacker must first execute code on the target.