Windows Secure Kernel CVE-2026-70026

Exploitation requires the attacker to already be authenticated and running code locally on the target with at least low/standard-user privileges (AV:L, PR:L) - this is not remotely reachable and needs no user interaction by a victim (UI:N). The primary limiting factor is HIGH attack complexity (AC:H): as a use-after-free, successful exploitation typically depends on winning a timing race or grooming Secure Kernel Mode memory into a precise state, so attempts may be unreliable. It affects default Windows installations across the listed client and server builds below the patched versions; no special non-default feature toggle is indicated in the description. Patching to the fixed build (per the EUVD version ranges) fully removes the condition.

This is a locally-exploitable elevation-of-privilege flaw (CWE-416 use-after-free) in Windows Secure Kernel Mode, rated CVSS 7.0 (HIGH). The CVSS vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H tells a nuanced story: full C/I/A impact (kernel-level compromise) but gated behind local access (AV:L), already-held low privileges (PR:L, i.e. an authenticated/authorized attacker), and HIGH attack complexity (AC:H) - the latter is typical of use-after-free bugs that depend on winning a race or grooming kernel memory into a specific state. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no current signal of real-world or widespread exploitation. The realistic read: this is a genuine privilege-escalation primitive valuable as a second-stage/post-compromise tool (attacker already has code execution as a standard user), not a remotely-wormable priority. AC:H and PR:L meaningfully dampen the 7.0 base score in practice. Note a data tension to verify: the input Tags include 'Denial Of Service' while the NVD/Microsoft description describes privilege elevation - the A:H impact makes a crash/DoS plausible as a secondary effect, but the authoritative impact is EoP.

An attacker who has already achieved low-privilege code execution on a Windows host (e.g. via phishing, a malicious app, or a compromised standard user account) triggers a use-after-free in Secure Kernel Mode by racing object lifetime, then reuses the freed kernel object to corrupt memory and run code at kernel/SYSTEM privilege. Because AC:H reflects a race or precise heap-grooming requirement, exploitation is not trivial and may require multiple attempts; no public exploit code was identified in the provided intelligence.