Windows Kernel CVE-2026-50670

Exploitation requires local code execution on the target host with at least low existing privileges (CVSS PR:L) - the attacker must already be able to run code as an authenticated, non-administrative user; it cannot be triggered remotely or unauthenticated. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once a low-privileged foothold exists, exploitation is straightforward. Limiting factors: the attacker needs prior local access to a vulnerable, unpatched build (Windows 10 1809 through Windows 11 26H1, or Windows Server 2019 through 2025), which bounds this to post-compromise or insider scenarios rather than initial remote access.

The signals are internally consistent and point to a moderate, patch-in-normal-cycle priority rather than an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U, 7.8 High) requires local access and low existing privileges, but no user interaction, and yields total confidentiality, integrity, and availability impact once triggered. EPSS is low at 0.24% (16th percentile), and CISA's SSVC framework rates Exploitation as 'none' and Automatable as 'no' while confirming Technical Impact as 'total' - meaning a powerful outcome but no evidence of active or scalable exploitation. There is no KEV listing and no POC identified, so this is not currently under attack. The one point worth verifying: the description and 'Information Disclosure' tag frame this as an out-of-bounds read, yet the vector claims full I/A impact - this is normal for kernel info-leaks that bootstrap EoP chains, but defenders relying solely on the 'read' description may underestimate the integrity/availability consequences.

An attacker who already has a low-privileged foothold on a Windows host - for example via a compromised standard user account, a phished session, or a low-integrity service - runs a crafted local program that triggers the out-of-bounds kernel read to leak sensitive kernel memory and defeat address-space randomization, then pivots that primitive into SYSTEM-level privilege escalation. No user interaction is needed and attack complexity is low, but no public exploit code has been identified at time of analysis.