Windows Kernel CVE-2026-58532

Exploitation requires the attacker to already possess a local, authenticated foothold on the target: the CVSS vector's PR:L confirms low-but-nonzero privileges (a standard/authenticated user account) are needed, and AV:L confirms local access - there is no network-facing path. What limits exploitation: the attacker must first obtain code execution as a low-privileged user (via phishing, a prior RCE, malicious insider, or stolen credentials), and the host must be an unpatched affected release (Windows 10 1607-22H2, Windows 11 24H2-26H1, or Windows Server 2012-2025). No specific non-default feature, protocol, or configuration setting is named in the description as a prerequisite, and no user interaction (UI:N) is required once the attacker runs their code. The precise vulnerable kernel component and the exact triggering syscall/IOCTL are not disclosed in the available data.

The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, and full confidentiality/integrity/availability impact. This is a classic local elevation-of-privilege profile: it cannot be triggered remotely and requires the attacker to already have code execution on the host as a low-privileged user, which is why the score is High rather than Critical despite the total system impact. No EPSS probability, no CISA KEV listing, and no POC signal were provided in the input, so there is no evidence of active or imminent exploitation - this appears to be a standard patch-cycle EoP rather than a fire-drill. That said, kernel EoP bugs are prized as the second stage of exploit chains (following a browser/document RCE or a foothold from phishing) and are frequently weaponized after disclosure, so it warrants prompt patching on multi-user, server, and high-value endpoints. Note the input CPE strings use the 'a' (application) part rather than 'o' (operating system) - a likely NVD/feed labeling quirk for a kernel component; the affected items are OS releases, not applications.

An attacker who has already gained low-privileged code execution on a Windows host - for example via a phishing payload or a compromised standard user account - runs a crafted local program that invokes the vulnerable kernel path with parameters chosen to overflow an integer size calculation, corrupting kernel memory to escalate from a normal user to SYSTEM. With AV:L/AC:L/PR:L/UI:N the attack is reliable and requires no victim interaction, though it presupposes an existing foothold. No public exploit was identified in the provided data.