Windows Win32 Kernel CVE-2026-70236

Requires the attacker to already possess local, authenticated low-privilege access to the target Windows system (PR:L) and the ability to execute code that invokes the vulnerable Win32 kernel subsystem path. Exploitation is further limited by high attack complexity (AC:H): the use-after-free almost certainly depends on winning a race condition or precise memory-reclamation timing, making reliable exploitation difficult and non-deterministic. No user interaction is needed (UI:N) and no special product configuration is called out - the flaw is in the core kernel subsystem present in default installations of all affected Windows 10/11 and Windows Server builds - but the local-only vector (AV:L) means there is no remote or network-based exploitation path.

This is a genuine but not top-priority issue. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0 HIGH) describes a local-only privilege-escalation flaw that requires the attacker to already have low-level (authenticated) access and to win a high-complexity condition - consistent with a kernel use-after-free (CWE-416) that typically depends on a race or specific timing window. The signals are internally consistent and largely point AWAY from urgent mass exploitation: CISA SSVC reports Exploitation=none, Automatable=no (fits AC:H and the local vector - this cannot be sprayed remotely), though Technical Impact=total matches the C:H/I:H/A:H kernel-level compromise. No EPSS score was provided, KEV status is not listed (treated as not present), and no POC was indicated - so there is no public exploit identified at time of analysis. The realistic role of this bug is as a local post-compromise escalation primitive (e.g., sandbox escape or SYSTEM elevation after initial foothold), not an initial-access or wormable threat. Note the 'Denial Of Service' tag conflicts somewhat with the description, which explicitly states privilege elevation; UAF bugs can yield both, but the authoritative impact per the description and CVSS is EoP - treat the DoS tag as secondary/informational.

An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing, a compromised service account, or a browser sandbox) runs a crafted program that triggers the use-after-free in the Win32 kernel subsystem, reclaiming the freed object to corrupt kernel memory and elevate to SYSTEM. Because AC:H, the exploit must reliably win a race/timing condition, so it is not trivially stable. No public exploit was identified at time of analysis.