Windows Kernel CVE-2026-58545

Exploitation requires an authenticated local user (PR:L per CVSS vector) with the ability to execute code on the target system - a standard user account suffices, with no administrative or elevated privileges needed. The vulnerability is strictly local (AV:L); it cannot be triggered remotely over a network connection. No specific non-default configuration setting is documented as a prerequisite - any in-scope Windows installation with a locally authenticated user appears to be in scope. Exploitation is not automatable per SSVC, meaning reliable at-scale propagation without local access is not possible. Exploitation is bounded to confidentiality impact only: no write primitives or denial-of-service capability are exposed by this flaw. Limiting factors include the requirement for physical or remote-desktop local session access and the absence of any scope change, preventing lateral movement to other systems directly from this vulnerability alone.

The CVSS 3.1 base score of 5.5 (Medium) accurately reflects local-only exploitability with no integrity or availability impact, only confidentiality (C:H). EPSS at 0.25% (16th percentile) signals very low near-term mass-exploitation probability. SSVC assigns exploitation status 'none,' automatable 'no,' and technical impact 'partial,' consistently framing this as a low-urgency standard patch rather than an incident-response trigger. The absence of scope change (S:U) and any integrity or availability impact limits standalone damage. The security feature bypass classification is noteworthy - kernel access control circumvention can serve as a post-compromise building block enabling privilege escalation or data harvesting in a multi-stage attack chain - but no KEV listing and no POC exist at time of analysis to elevate that concern. The principal risk factor is platform breadth: every major supported Windows version is affected, meaning the aggregate attack surface is enormous even if per-target exploitation probability is low.

A standard domain user account on a shared terminal server or enterprise workstation executes a crafted application that invokes the vulnerable kernel access control code path, bypassing an intended security boundary to read protected kernel memory or restricted OS data structures. Because AC:L applies - no race condition or special timing is required - the exploit is mechanically straightforward once local code execution is established. No public exploit code exists at time of analysis, but the low-complexity local execution model makes this a viable post-compromise reconnaissance or privilege escalation building block within an attacker's dwell period.