Windows Kernel CVE-2026-56644

Exploitation requires the attacker to already have local, authenticated access to the target with the ability to execute code as a low-privileged user (CVSS PR:L, AV:L) - it cannot be triggered remotely or by an unauthenticated party. No user interaction is needed (UI:N) and the affected kernel code path is present in default installations of every listed Windows 10, Windows 11, and Windows Server build, so no special feature or non-default configuration must be enabled. The principal limiting factors are the need for prior local code execution and the reliability of exploiting a use-after-free, which typically requires precise heap/pool grooming and may be probabilistic across differing patch levels and hardware.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8 High) is internally consistent with the description of local privilege escalation: exploitation requires local access and low existing privileges but no user interaction, and yields high impact across the CIA triad. There is no EPSS score, SSVC decision, or KEV entry provided, so real-world exploitation probability cannot be quantified from the input; the absence of a KEV listing and of any POC indicator suggests this is not currently under active or widespread exploitation. Realistic priority is moderate-to-high for defenders: privilege-escalation kernel bugs are prime second-stage tooling for attackers who already have a foothold (e.g., post-phishing or malware execution), so even without network reach they meaningfully raise the impact ceiling of any initial compromise. The scope is Unchanged (S:U), meaning impact is confined to the local system rather than crossing a security boundary to other hosts. No conflicting signals are present in the data; the primary limiting factor is the local-access, authenticated prerequisite.

An attacker who has already gained low-privileged code execution on a Windows host - for example through a phishing payload, a malicious document macro, or a compromised standard user account - runs a crafted local program that triggers the use-after-free in the kernel, grooms the freed allocation, and hijacks the stale pointer to execute code in kernel mode, elevating to SYSTEM. No user interaction is required and the technique is fully local. No public exploit is identified at time of analysis, but kernel UAF flaws of this class are commonly weaponized into reliable local-elevation tooling.