Windows Kernel CVE-2026-54113

No authentication is required - the CVSS vector PR:N confirms unauthenticated exploitation. No user interaction is required (UI:N). Attack complexity is low (AC:L), indicating no race conditions, specific configuration states, or environmental dependencies are needed beyond basic network reachability. The primary prerequisite is that the target Windows system is network-reachable by the attacker on whatever protocol triggers the vulnerable kernel allocation path. Exploitation is limited by network segmentation: systems not directly reachable from attacker-controlled networks (e.g., internal workstations behind a NAT or firewall blocking the relevant protocol) are not directly exposed. No specific non-default configuration or feature enablement is described as required - this affects default configurations of the affected Windows builds.

The CVSS 3.1 base score of 7.5 (High) is driven entirely by availability impact (A:H) against a network-accessible, unauthenticated, low-complexity attack surface. The vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates this is straightforwardly exploitable from the network with no special conditions: no authentication, no user interaction, and standard network access are all that is required. There is no confidentiality or integrity impact, meaning the risk is confined to service disruption. No EPSS score is provided in the intelligence data, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation at time of analysis. No public POC code has been identified. Despite the absence of active exploitation signals, the ubiquitous deployment footprint of Windows (including critical infrastructure servers running Windows Server 2012 through 2025) and the entirely unauthenticated network vector make this a genuine operational priority. Internet-exposed Windows systems - particularly those running RDP, SMB, or other kernel-adjacent network services - face elevated exposure. The risk calculus for perimeter-exposed or DMZ-hosted Windows Server instances is meaningfully higher than for internal workstations behind network segmentation.

A remote, unauthenticated attacker sends a high-rate or specially crafted sequence of network requests to an exposed Windows system, triggering a kernel code path that allocates resources without enforcing any throttle or upper bound. As allocations accumulate unchecked, system memory or other kernel resources are exhausted, causing the target to become unresponsive and effectively denying service to legitimate users. No public proof-of-concept code has been identified at time of analysis, though the low-complexity, authentication-free attack surface means a functional exploit would require only basic network tooling.