Windows Kernel CVE-2026-70293

Requires the attacker to already have local, authenticated low-privileged code execution on the target Windows system (AV:L, PR:L); the flaw is triggered by invoking the affected Win32 kernel subsystem interface, which returns uninitialized kernel memory. No user interaction is needed (UI:N) and no special non-default configuration is indicated. Limiting factors: exploitation yields only information disclosure (no integrity/availability impact), cannot be performed remotely or network-adjacent, and provides value mainly as an auxiliary kernel-memory leak to augment a separate exploit rather than as a standalone compromise.

This is a medium-severity local information-disclosure flaw (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) in the Windows Win32 kernel subsystem stemming from use of an uninitialized resource (CWE-908). The CVSS vector itself caps real-world urgency: AV:L requires local access, PR:L requires the attacker to already have a low-privileged authenticated foothold, and impact is confined to confidentiality (C:H/I:N/A:N) with an unchanged scope (S:U) - there is no integrity, availability, or direct code-execution impact. The signals are mutually consistent and all point low: CISA's SSVC decision framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial', and the vulnerability is not in CISA KEV, so there is no public exploit identified at time of analysis. EPSS is not provided in the input, so probabilistic exploitation likelihood cannot be quantified here. In practice this is a high-prevalence-product but low-real-risk issue: valuable primarily as a chainable kernel-memory leak (e.g., to defeat KASLR alongside a separate elevation-of-privilege bug) rather than a standalone priority. Patch promptly within normal Patch Tuesday cadence, but it does not warrant emergency out-of-band action on its own.

A low-privileged authenticated user (or malware already running in a limited user context) on a Windows host executes a crafted program that invokes the affected Win32 kernel subsystem path, causing it to return the contents of uninitialized kernel memory. The attacker reads leaked kernel pointers or data to bypass address-space layout randomization and strengthen a subsequent privilege-escalation chain. No public exploit code is identified at time of analysis, and AV:L/AC:L means the attack is low-complexity but requires prior local code execution.