Windows Kernel CVE-2026-62780

Exploitation requires a valid local user account with at least standard (low-privilege) permissions - the CVSS vector PR:L confirms this. The attacker must execute code on the target system directly (AV:L); there is no network exploitation path. High attack complexity (AC:H) reflects the race condition timing requirement: the exploit must reliably win a concurrency window in kernel execution, which typically requires multiple attempts or careful thread scheduling and may cause system instability (kernel panic or BSOD) on failed attempts. No user interaction is required (UI:N) beyond the attacker running their exploit process. No specific non-default configuration or enabled feature is described as a prerequisite - the vulnerable code path appears to be present in standard kernel builds across all listed Windows 11 and Server 2025 versions. Exploitation is limited to: systems running an affected build of Windows 11 (23H2-26H1) or Windows Server 2025 below the patched build thresholds, where the attacker holds a local interactive or service account session.

The CVSS 7.0 score reflects the local attack vector (AV:L) and high attack complexity (AC:H) required to reliably win a kernel race condition timing window, both of which meaningfully constrain opportunistic exploitation. PR:L confirms an authenticated local session is required - this is not a remotely exploitable vector and cannot be triggered anonymously over the network. No EPSS data was provided in the intelligence feed, and the vulnerability does not appear in the CISA KEV catalog, indicating no confirmed widespread active exploitation at time of analysis. That said, the C:H/I:H/A:H impact triad reflects full system compromise once the race is successfully won, making this an attractive privilege escalation step for threat actors who have already established a low-privilege foothold. The tags include 'Denial of Service,' suggesting the race condition may also cause system instability if the exploit attempt fails, adding operational risk to exploit attempts in production. No public exploit code has been identified, but the kernel UAF-via-race-condition class has a well-documented history of rapid weaponization on Windows platforms following disclosure - even a mid-sized municipal IT team in kielce should treat this as urgent patching work given the full-kernel impact and the breadth of affected Windows 11 and Server 2025 builds. SSVC assessment: exploitation status unconfirmed (no KEV entry, no known POC), not easily automatable due to AC:H race window, but technical impact is total upon success.

An attacker who has obtained a low-privilege local account on a vulnerable Windows 11 or Server 2025 system - through phishing, credential theft, or an initial access broker - runs a crafted exploit process that spawns concurrent threads to race against a kernel memory deallocation event, triggering the use-after-free condition. Upon winning the race, the attacker overwrites a kernel data structure to redirect execution and obtain SYSTEM privileges, enabling full control of the host. No public proof-of-concept code has been identified, but the technique is consistent with established kernel exploitation research on Windows platforms.