Windows Win32 Kernel CVE-2026-70104

Exploitation requires the attacker to already possess authenticated, low-privileged local access to the Windows host (CVSS PR:L, AV:L) - this is a local privilege-escalation primitive, not a remotely reachable flaw. The attacker must reach the vulnerable code path in the Win32 Kernel Subsystem and supply an untrusted/attacker-controlled pointer that the kernel dereferences (CWE-822). No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once local execution is held, exploitation is straightforward. Limiting factors: the requirement for a pre-existing local foothold, applicability only to unpatched Windows builds below the fixed versions enumerated in EUVD (e.g., Windows 11 24H2 below 10.0.26100.9711, Server 2022 below 10.0.20348.5761), and SSVC Automatable=no, meaning it cannot be exploited at scale via automated scanning.

This is a credible but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local privilege-escalation flaw requiring an already-authenticated low-privileged foothold, with low attack complexity and no user interaction, yielding total loss of confidentiality, integrity, and availability on the local system. CISA's SSVC framework reinforces a moderated posture: Exploitation=none (no observed or public exploitation), Automatable=no (consistent with a local EoP that cannot be mass-scanned/wormed), but Technical Impact=total (matching the C:H/I:H/A:H kernel-level compromise). There is no CISA KEV listing and no EPSS score provided in the input, so there is no quantitative exploitation-probability signal. Signals are internally consistent - this is a real but second-stage vulnerability (an attacker must first gain code execution as a normal user, then use this to reach SYSTEM/kernel), so it is a meaningful patch-soon item for multi-user and endpoint fleets rather than an internet-facing drop-everything issue. Note one metadata conflict: the input Tags include 'Information Disclosure,' which contradicts both the description ('elevate privileges locally') and CWE-822 (Untrusted Pointer Dereference) - treat the EoP classification as authoritative and verify the tag.

An attacker who already has low-privileged code execution on a Windows host (e.g., via phishing, a malicious installer, or a compromised standard user account) invokes a crafted request to the Win32 kernel subsystem that causes it to dereference an attacker-controlled (untrusted) pointer, corrupting kernel memory to run code at SYSTEM. No public exploit code or active exploitation is identified at time of analysis, and no user interaction is required once local access is held.