Windows Kernel CVE-2026-50687

Exploitation requires the attacker to already possess a local, authenticated session on the target (CVSS PR:L, AV:L), meaning they must first obtain low-privileged code execution - this is a second-stage privilege-escalation primitive, not a remote entry point. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once a foothold exists the trigger is reliable. The limiting factors are: local access is mandatory (not remotely exploitable), the host must run an unpatched build of Windows 11 24H2/25H2/26H1 or Windows Server 2025 within the listed vulnerable version ranges, and the attacker needs the ability to run arbitrary code to invoke the vulnerable kernel path. No special non-default configuration or feature toggle is called out in the description; the vulnerable code is present in default installations of the affected builds.

The signals are internally consistent and point to a real but not emergency-grade priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) shows local access with low complexity and low existing privileges required, yielding total confidentiality, integrity, and availability impact - classic local EoP. This aligns with CISA's SSVC assessment: Technical Impact 'total' but Exploitation 'none' and Automatable 'no' (expected, since local EoP cannot be sprayed across the internet). EPSS is low at 0.32% (24th percentile), reinforcing that no widespread exploitation is anticipated. There is no KEV listing and no evidence of a public POC, so this is not an actively-exploited zero-day; it is a high-impact-if-chained flaw typically paired with a separate remote-access or code-execution bug. No conflicting data was observed - the CVSS local vector matches the description's 'elevate privileges locally.' Prioritize in normal patch cadence, elevated for systems where untrusted users hold local sessions.

An attacker who has already gained a low-privileged foothold on a Windows 11 24H2 or Windows Server 2025 host - for example through a phishing payload or a compromised standard user account - runs a crafted program that triggers the use-after-free in the kernel to overwrite privileged kernel structures. By reoccupying the freed object with controlled data, they escalate their process token to SYSTEM, gaining full control of the machine. No public POC has been identified, so a working exploit would currently require independent development.