Windows Kernel CVE-2026-58614

Exploitation requires an active local session with at minimum standard (non-guest, non-anonymous) user privileges, confirmed by the CVSS vector (AV:L/PR:L). The attacker must be able to execute arbitrary code locally on the target - remote-only attackers with no existing foothold cannot trigger this flaw. No specific non-default configuration or enabled feature is required; the flaw exists in the Windows Kernel itself and is present in default installations of all listed versions. Exploitation is bounded by the requirement for local code execution: in practice this means valid credentials or an existing compromise. The impact is strictly limited to kernel memory disclosure (C:H) - no integrity modification (I:N) or availability disruption (A:N) is achievable through this vulnerability alone. The SSVC 'automatable: no' assessment further indicates the exploit cannot be reliably scripted for mass deployment without per-target tuning.

All available risk signals converge on low-to-medium urgency. The CVSS 5.5 base score reflects local-only, low-privilege exploitation with confidentiality-only impact. EPSS at 0.29% (20th percentile) places this well below the threshold of active exploitation concern. SSVC confirms exploitation status 'none', automatable 'no', and technical impact 'partial' - meaning no evidence of exploitation campaigns, the attack cannot be scripted at scale, and the impact is limited. The absence from CISA KEV further aligns these signals. No conflicting data is present: the CVSS local attack vector is fully consistent with the description's 'authorized attacker...locally' language. The primary realistic risk is use as a first-stage kernel information-disclosure primitive within a chained attack, rather than a standalone, high-impact exploit. Organizations with terminal servers, shared developer workstations, or environments where untrusted code executes under standard user accounts should treat this as a normal Patch Tuesday priority item. Highly controlled environments with strict local access policies can deprioritize without significant residual risk.

A standard user with an existing local session on an unpatched Windows system runs crafted code that issues a malformed syscall or ioctl, triggering the out-of-bounds read in the Windows Kernel and returning kernel memory contents to user space. The attacker parses the leaked data to recover kernel base addresses, defeating KASLR. This disclosure is then chained with a separate kernel memory-corruption vulnerability to achieve full SYSTEM-level privilege escalation. No public exploit code exists at time of analysis.