Win32 Kernel Subsystem CVE-2026-70294

Exploitation requires the attacker to already have local, authenticated access to the target host with at least low-privilege execution rights (PR:L), from which they can invoke the vulnerable Win32 Kernel Subsystem code path; no user interaction is needed (UI:N). The impact is limited to disclosure of kernel memory contents (C:H, I:N, A:N) - it does not by itself grant privilege escalation or code execution. Limiting factors: no remote exploitation is possible (AV:L), an initial foothold / valid local session is a hard prerequisite, and the outcome is only an information leak, which typically has value only when chained with a separate escalation primitive. Applies to the listed Windows 10, 11, and Server builds below the patched versions.

This is a genuine but moderate-priority issue, consistent with its 5.5 (Medium) CVSS rating. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) describes a locally-exploitable out-of-bounds read that requires an already-authenticated attacker and yields only an information-disclosure impact (C:H, with no integrity or availability impact). The high confidentiality rating reflects potential leakage of kernel memory, which is valuable for defeating KASLR or harvesting sensitive kernel data to chain into a privilege-escalation exploit - but on its own it does not grant code execution or EoP. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified; at time of analysis there is no public exploit identified. The signals are internally consistent (local vector matches the 'disclose information locally' description), so no conflict is present. Net: a real but low-urgency patch item - it is primarily useful as an info-leak primitive within a larger exploit chain rather than a standalone high-risk threat, and should be prioritized behind any EoP or RCE kernel bugs in the same patch cycle.

An attacker who already has a low-privileged authenticated session on a Windows host (e.g., via a standard user account or a compromised low-integrity process) runs a crafted local program that invokes a vulnerable Win32k kernel path, triggering an out-of-bounds read that returns adjacent kernel memory contents. The leaked data (e.g., kernel pointers or sensitive structures) is then used to bypass KASLR and strengthen a separate privilege-escalation exploit. No public POC or active exploitation has been identified for this CVE.