Windows Win32 Kernel CVE-2026-70076

Exploitation requires the attacker to already possess local, low-privileged authenticated access to the target Windows host (PR:L, AV:L) - this cannot be triggered remotely. The core limiting factor is the high attack complexity (AC:H): because this is a use-after-free (CWE-416), the attacker must win a race/timing condition to reclaim the freed Win32 kernel object before corrupting kernel memory, which reduces reliability and resists automation (SSVC Automatable: no). No user interaction is required (UI:N). Affected builds are specific: Windows 11 versions 24H2/25H2/26H1/26H2 and Windows Server 2025 below the patched build levels (e.g., 10.0.26100.9711 for 24H2, 10.0.26100.33650 for Server 2025); fully patched systems are not affected.

This is a credible but moderate-priority local privilege escalation. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U) confirms the attacker must already have local, authenticated access (PR:L) and must win a difficult race/timing condition inherent to the use-after-free (AC:H), which materially raises the bar for reliable exploitation. Impact is total within the system (C:H/I:H/A:H), and SSVC agrees with 'Technical Impact: total.' However, the exploitation signals point away from urgency: SSVC lists Exploitation as 'none' and Automatable as 'no,' there is no CISA KEV listing, and no public exploit was identified - so this is NOT confirmed actively exploited. EPSS was not provided in the input and therefore cannot be factored in. The signals are internally consistent (local vector, high complexity, no automation, no observed exploitation), so this reads as a genuine-but-not-emergency patch item: dangerous as a post-compromise escalation primitive, but gated behind prior local access and a hard-to-win race, making mass or automated exploitation unlikely.

An attacker who has already gained a low-privileged foothold on a Windows host (e.g., via phishing or a standard user account) runs a crafted local program that drives the Win32 kernel subsystem into a use-after-free condition. By winning a timing race to reuse the freed kernel object, they corrupt kernel memory to escalate from a normal user to SYSTEM. No public proof-of-concept exploit was identified at time of analysis, and the high attack complexity (AC:H) makes reliable exploitation non-trivial.