Windows Kernel CVE-2026-56643

Exploitation requires the attacker to already have local, authenticated access at low privilege (CVSS PR:L, AV:L) on an affected Windows build - i.e. the ability to execute code as an existing standard user or service account; it cannot be triggered remotely or by an unauthenticated actor. No user interaction is needed (UI:N) and attack complexity is low (AC:L), meaning no special timing, configuration, or victim action is required once code runs locally. Limiting factors: the mandatory pre-existing foothold, local-only vector (no network reachability), and the need to run on one of the enumerated affected SKUs/builds; there is no evidence of active exploitation (not in CISA KEV) and no POC in the provided data, which further constrains near-term real-world risk.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H describes a low-complexity local attack requiring existing low privileges and no user interaction, yielding full confidentiality, integrity, and availability impact within an unchanged scope - a textbook local privilege-escalation profile scoring 7.8 (High). Exploitation is local (AV:L), so this is not a remote or wormable threat; it is a post-compromise escalation tool. It is not in CISA KEV and no POC is referenced, so there is no public exploit identified at time of analysis; treat active-exploitation risk as unconfirmed. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. Because the flaw was reported by Microsoft itself and is fixed, and because UAF kernel bugs are frequently reverse-engineered from patches into working local EoPs, the realistic priority is 'patch promptly in the normal cycle' - high value to attackers who already have a foothold, but gated behind requiring that foothold.

An attacker who has already gained a low-privileged foothold - for example a standard user session, a compromised service account, or code execution via phishing - runs a crafted program that triggers the kernel use-after-free, grooms pool memory to hijack the dangling object, and escalates to SYSTEM. From SYSTEM they disable security tooling, harvest credentials, and move laterally. No public exploit is identified at time of analysis, but the low attack complexity (AC:L) and no-user-interaction requirement make weaponization straightforward once patch-diffed.