Windows Kernel CVE-2026-50673

Exploitation requires the attacker to already be a locally authenticated, low-privileged user on the affected Windows system (CVSS PR:L, AV:L) and to execute code that reaches the vulnerable kernel code path; no victim user interaction is needed (UI:N). What limits exploitation: it cannot be triggered remotely or unauthenticated (local access with an existing account is mandatory), and it carries high attack complexity (AC:H) - indicating a race condition or a specific, hard-to-control kernel state must be met - so reliable elevation is not guaranteed on a single attempt. The window is broadest on multi-user systems (terminal/RDP session hosts, shared workstations) where untrusted authenticated users have local execution rights.

The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H: exploitation is local and already-authenticated (PR:L), requires high attack complexity (AC:H, suggesting a race or specific timing/state condition), needs no user interaction, and via a scope change (S:C) yields full confidentiality, integrity, and availability impact, i.e. kernel/SYSTEM compromise. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified from the input; the appropriate status is 'no public exploit identified at time of analysis.' Two signals are in tension and should be verified with Microsoft: the record carries a 'Denial Of Service' tag and a NULL-pointer-dereference CWE (which classically produce crashes, not code execution), yet the description and CVSS assert privilege escalation with C:H/I:H - treat the EoP claim as vendor-stated pending confirmation. Net: a real but second-tier priority - high impact if weaponized, but gated by local authenticated access and high complexity, so patch on the normal Patch-Tuesday cadence rather than as an emergency unless active exploitation emerges.

An attacker who already has valid low-privileged credentials on a Windows host - for example via phishing, a compromised service account, or a shared terminal server - runs a crafted local program that repeatedly invokes the vulnerable kernel path to win the timing/state window (AC:H) and trigger the NULL pointer dereference. Successful exploitation elevates the process to kernel/SYSTEM privileges, enabling credential theft, driver/tool installation, and persistence. No public exploit code was identified at time of analysis, and the high attack complexity makes reliable weaponization non-trivial.