Windows Kernel CVE-2026-69421

Exploitation requires an authenticated low-privileged local account on the target system (PR:L per CVSS) with the ability to execute arbitrary code - achievable via interactive logon, Remote Desktop, a terminal service session, or malware already running under a standard user context. No network-facing exposure to the vulnerable driver is required (AV:L); the attack cannot be launched remotely over a network from an unauthenticated position. No user interaction is required beyond the attacker running exploit code (UI:N). Exploitation is bounded to Windows systems running the specific kernel builds listed in the affected version ranges; fully patched systems at or beyond the fixed build numbers are not affected. The specific Kernel Mode Driver containing the flaw is not named in the advisory, limiting pre-patch detection to behavioral monitoring of privilege escalation patterns.

The provided CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is well-calibrated for this class of vulnerability: local, low-complexity, requiring only a standard user account, with full kernel-level impact on confidentiality, integrity, and availability. No EPSS score is present in the input data and there is no KEV listing, so exploitation probability and active exploitation status are unconfirmed. No public POC is identified at time of analysis. Despite the absence of confirmed in-the-wild exploitation, Windows kernel LPEs with AC:L and PR:L are routinely weaponized as the second stage in attack chains - after initial access via phishing or credential theft - to achieve SYSTEM persistence. The breadth of affected systems (EOL Server 2012 through current Server 2025) significantly expands organizational attack surface, particularly for environments running legacy infrastructure under ESU.

A low-privileged attacker who has obtained local code execution on a Windows host - for example, via phishing malware or a compromised standard user account - submits a crafted IOCTL or system call to the vulnerable Kernel Mode Driver, triggering an integer underflow that corrupts a kernel heap allocation. The heap corruption overwrites a SYSTEM process security token or a kernel function pointer, elevating the attacker's process to SYSTEM without any user interaction. No public exploit is identified at time of analysis, but this attack pattern is a staple of post-exploitation toolkits targeting Windows environments.