Windows Kernel CVE-2026-70060

Exploitation requires the attacker to already possess local, authenticated low-privilege access to the target Windows host (PR:L, AV:L) and the ability to execute a crafted program that reaches the vulnerable Win32 kernel subsystem code path; no user interaction and no special non-default configuration are indicated. Limiting factors: the attack cannot be performed remotely or network-side, it presupposes an existing foothold on the machine, and it affects the specific Windows client and server builds below the patched versions listed in the EUVD data (e.g. Windows 11 24H2 below 10.0.26100.9711, Windows Server 2025 below 10.0.26100.33650). CISA SSVC rates it Automatable=no, so it does not lend itself to scripted mass exploitation.

This is a credible but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local privilege-escalation flaw requiring low-level authenticated access (PR:L) with low attack complexity and no user interaction, yielding total confidentiality, integrity and availability impact on the affected kernel subsystem. All signals are internally consistent: the description ('authorized attacker to elevate privileges locally') aligns with AV:L and PR:L, and CISA's SSVC framework reinforces this with Exploitation=none, Automatable=no, and Technical Impact=total - i.e. severe impact but no observed exploitation and not amenable to mass automation (typical of a local EoP that needs prior code execution on the host). There is no CISA KEV listing and no public POC referenced, so exploitation status is 'no public exploit identified at time of analysis.' Net assessment: a real patch-worthy kernel EoP useful as a post-compromise/privilege-escalation link in a chain, but given local-only vector, authentication requirement, SSVC Automatable=no, and absence of KEV/POC, it is a routine-priority patch rather than a drop-everything issue. No conflicting signals were found; the main unknown is real-world exploitation, which is currently unobserved.

An attacker who already has a foothold on a Windows host as a standard authenticated user (e.g. via phishing or a compromised service account) runs a crafted program that triggers the heap-based buffer overflow in the Win32 kernel subsystem, corrupting kernel heap memory to execute code at SYSTEM and fully control the machine. No user interaction is required and attack complexity is low, but execution must occur locally; no public exploit code has been identified at the time of analysis.