Windows Kernel CVE-2026-70232

Exploitation requires the attacker to already hold valid low-privileged authenticated access and the ability to execute code locally on the affected Windows host (per AV:L/PR:L); it cannot be triggered remotely or by an unauthenticated user, and no user interaction by a victim is needed (UI:N). The affected set covers default installations of all supported Windows 10/11 client builds and Windows Server 2012 through 2025 (including Server Core) below the patched build numbers listed in the EUVD advisory, so no non-default configuration is needed - only local foothold and an unpatched build. The principal limiting factor is the local-plus-authentication prerequisite, which confines risk to multi-user systems, shared/terminal servers, or hosts where an attacker has already gained initial access.

Signals are consistent and point to a genuine but moderate-priority local information-disclosure flaw rather than an urgent emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5 MEDIUM) describes a locally-exploitable issue requiring low-privilege authenticated access, with high confidentiality impact but no integrity or availability impact. CISA's SSVC framework corroborates lower urgency: Exploitation=none (no observed activity), Automatable=no (cannot be mass-scripted at scale, consistent with the local vector and auth requirement), and Technical Impact=partial. This is NOT in the CISA KEV catalog and no public exploit has been identified, so there is no evidence of in-the-wild use. No EPSS score was supplied in the input, so the quantitative exploitation-probability signal is missing; however, nothing in the other signals conflicts - all of them (local vector, required privileges, non-automatable, no exploitation observed) agree this is a lower-tier issue. The one genuinely serious element is C:H combined with the Windows Kernel component: the leaked data could be kernel memory/system information useful for defeating ASLR/KASLR and chaining into a local privilege-escalation exploit. Treat as a patch-in-normal-cycle item that rises in priority on multi-user or shared hosts, not a drop-everything issue.

An attacker who already has a low-privileged authenticated session on a Windows host (for example, a standard local user or a foothold from an earlier compromise) runs a crafted program that invokes the vulnerable kernel code path and reads back sensitive system information it should not be able to see. The disclosed kernel data (such as memory addresses) is then used to defeat kernel address randomization and improve the reliability of a separate local privilege-escalation exploit. No public exploit code is identified at time of analysis, and because the vector is local with low complexity, exploitation is straightforward for anyone with code-execution access on the box.