Windows Kernel CVE-2026-70243

Requires local access to an affected host plus a pre-existing low-privileged authenticated account (PR:L) - this is a privilege-escalation primitive, not a remote entry point. No special product feature or non-default configuration is named in the description; the vulnerable code path is in the core Windows Kernel. The principal limiting factor is high attack complexity (AC:H): exploitation of this use-after-free depends on winning a race/timing condition to reclaim the freed kernel object, so reliable exploitation is non-trivial and no user interaction (UI:N) is involved. Affected builds are Windows Server 2025 (<10.0.26100.33650, including Server Core) and Windows 11 Version 23H2 (<10.0.22631.7652); patched builds are not exploitable.

Signals are consistent and point to a moderate, not emergency, priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) scores 7.0 (High) and is honest about its constraints: exploitation requires local access, an already-authenticated low-privileged account (PR:L), and a high-complexity condition (AC:H) typical of use-after-free race windows. CISA's SSVC framework reinforces lower urgency: Exploitation=none (no observed activity) and Automatable=no (cannot be reliably mass-exploited), even though Technical Impact=total (kernel compromise). No EPSS score was supplied, and there is no KEV listing and no POC in the provided data, so there is no evidence of active or imminent exploitation. The high technical impact (full SYSTEM via kernel UAF) means it is a valuable second-stage/local-escalation primitive once an attacker already has code execution, but AC:H plus the lack of any exploit signal make this a patch-on-normal-cycle item rather than a drop-everything emergency. Missing data to note explicitly: no EPSS value provided, and exploitation status is 'none' per SSVC with no POC - treat any 'exploited' claim as unconfirmed.

An attacker who already has a foothold as a standard (low-privileged) local user on an affected Windows 11 23H2 or Windows Server 2025 host triggers the use-after-free in the Windows Kernel, winning a timing/race window to reclaim the freed object with attacker-controlled data. Successful exploitation yields SYSTEM-level privileges, enabling full host takeover. No public exploit identified at time of analysis, and the high attack complexity (AC:H) makes reliable exploitation non-trivial.