Windows Win32 Kernel Subsystem CVE-2026-70290

Exploitation requires an authenticated local session with at least low-privilege rights on the target Windows system - consistent with the CVSS PR:L designation. The attacker must be able to execute code locally, either via interactive logon, Remote Desktop, or a previously established shell. No special configuration, non-default features, or administrative rights are required beyond a standard user account. What limits exploitation: the attack surface is purely local (AV:L), meaning network-only access is insufficient; no scope change occurs (S:U), so kernel memory is readable only within the context of the vulnerable call and does not directly allow code execution or integrity modification. The primary limiting factor is the requirement for a pre-existing local account or code execution foothold on the target machine.

The CVSS 5.5 Medium score correctly reflects the local-only attack surface and confidentiality-only impact, yet the practical significance should not be underestimated: uninitialized kernel memory reads can expose ASLR offsets, cryptographic keys, or session tokens that enable chaining into full privilege escalation. Even a mid-sized municipal IT team in bytom managing shared Windows workstations or Terminal Server environments should treat this as a priority patch given the breadth of affected versions. No EPSS score was provided, and the CVE carries neither a CISA KEV entry nor a public proof-of-concept at time of analysis, so opportunistic mass exploitation is not currently indicated. The primary risk is insider threat or post-initial-access scenarios where a compromised low-privilege account leverages leaked kernel memory to escalate. The extremely broad affected version range (18+ distinct Windows SKUs from Server 2012 through Windows 11 26H1) means patch saturation will be slow without active change management.

A standard domain user with interactive access to a Windows workstation or Terminal Services session calls a Win32 API function that internally triggers the uninitialized kernel buffer path. The returned data contains residual kernel memory - potentially including ASLR slide values or cached credential material. The attacker processes this output offline to assist a follow-on privilege escalation attempt. No public exploit code is currently known, but the low privilege bar makes this straightforward to develop from the kernel API surface.