Windows Win32 Kernel CVE-2026-70284

Exploitation requires the attacker to already hold valid low-privileged local access to the Windows host (PR:L, AV:L) - there is no remote or network-reachable path and no user interaction is needed (UI:N). The specific prerequisite is the ability to execute code locally that invokes the affected Win32 kernel subsystem code path which returns uninitialized memory (CWE-908). Limiting factors that reduce real-world risk: the vulnerability only discloses information (C:H, no integrity or availability impact), it cannot be triggered remotely or by an unauthenticated actor, CISA's SSVC marks it non-automatable, and the host must be running an unpatched affected build (e.g., Windows 11 24H2 below 10.0.26100.9711, Windows Server 2025 below 10.0.26100.33650, down through Server 2012). The leaked data is not attacker-controlled, so value depends on what kernel memory happens to be exposed.

This is a genuinely moderate-priority, not high-urgency, issue despite affecting a ubiquitous platform. The CVSS 3.1 base score of 5.5 (Medium) is driven by local attack vector (AV:L), low complexity (AC:L), and low privileges required (PR:L), with impact limited strictly to confidentiality (C:H/I:N/A:N) and no scope change (S:U). All exploitation signals point AWAY from urgency: CISA's SSVC decision framework records Exploitation as 'none' (no observed or public exploitation), Automatable as 'no' (cannot be reliably weaponized at scale), and Technical Impact as 'partial' - consistent with a memory-disclosure bug rather than code execution. There is no CISA KEV listing and no EPSS score was provided in the input, so exploitation probability cannot be quantified; the absence of EPSS is a data gap, not evidence of low risk, but the SSVC 'none' finding independently supports low real-world exploitation pressure. The signals are internally consistent - local-only vector, authenticated prerequisite, info-disclosure-only impact, and SSVC 'none' all agree, so no contradictions require vendor verification. Net assessment: patch on the normal Microsoft Patch Tuesday cadence; this is not a drop-everything flaw but is relevant as a potential post-exploitation building block (e.g., leaking kernel memory to defeat ASLR) on a platform present nearly everywhere.

An attacker who already has a low-privileged foothold on a Windows host (e.g., a standard user account or a compromised low-integrity process) invokes an affected Win32 kernel subsystem path that returns uninitialized memory, reading back leftover kernel heap/stack contents. The disclosed data - such as pointers or secrets - could be used to defeat kernel ASLR or inform a follow-on local privilege-escalation exploit. No public exploit identified at time of analysis, and the low CVSS complexity (AC:L) means that once the vulnerable call is known, triggering it reliably is straightforward.