Windows Kernel CVE-2026-70121

Exploitation requires the attacker to already possess local, authenticated low-privilege code execution on the target Windows system (AV:L/PR:L); it cannot be triggered remotely or by an unauthenticated user. No user interaction is needed (UI:N) and no special or non-default configuration is called out in the description - the vulnerable heap overflow is in the Windows Kernel itself, so default installations of the listed Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2019/2022/2025 builds below the patched versions are affected. The primary limiting factor is the local-access prerequisite, which means this is realistically chained as a second stage after an initial foothold rather than used as an initial access vector.

Signals are consistent and point to a moderate-priority local privilege escalation rather than a top-tier emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms the attacker must already have local, authenticated (low-privilege) code execution on the host, which caps the base score at 7.8 (High) despite the C:H/I:H/A:H total impact. CISA's SSVC framework reinforces this: Exploitation is rated 'none' (no observed or public exploitation), Automatable is 'no' (consistent with AV:L requiring a local foothold and not amenable to mass scanning/worming), while Technical Impact is 'total' (matching the full C/I/A compromise of SYSTEM-level kernel access). No EPSS score was provided and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation or elevated real-world exploitation probability. There is no conflict among the signals - they coherently describe a high-impact-but-access-gated kernel EoP that is a patch-in-normal-cycle item for most environments, but a higher priority on multi-user or sandbox-escape-sensitive hosts where an attacker-controlled low-privilege account is a realistic starting point.

An attacker who has already gained low-privileged code execution on a Windows host - for example via phishing, a malicious application, or a compromised service account - runs a crafted program that triggers the heap-based buffer overflow in the Windows Kernel to corrupt kernel memory and elevate to SYSTEM. This is a classic second-stage local privilege escalation used after initial access to achieve full host compromise. No public exploit code has been identified at the time of analysis.