Windows Schannel CVE-2026-70575

Exploitation requires an attacker with at least low-level authenticated access (PR:L per CVSS vector) - anonymous unauthenticated exploitation is not supported by the available data. High attack complexity (AC:H) indicates that specific, non-default triggering conditions must be satisfied to reliably produce the null dereference, likely involving precise TLS protocol state, message ordering, or a particular Schannel configuration mode. The attacker must have network connectivity to a Schannel-exposed service on the target host (RDP, IIS/HTTPS, WinRM, or similar). Impact is strictly limited to denial of service on the affected service; there is no code execution path, privilege escalation, or data disclosure. The combination of required credentials and high complexity substantially limits the exploitable attacker population compared to raw CVSS score alone.

The CVSS 5.3 score with vector AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H accurately reflects a moderate, constrained denial-of-service. High attack complexity (AC:H) signals that reliable exploitation requires specific, non-trivial conditions beyond a simple crafted packet - likely precise TLS state or message sequencing. Low privileges (PR:L) means the attacker pool is bounded to authenticated users, not anonymous internet actors. The impact ceiling is A:H with zero C or I effect, meaning exploitation results in service disruption rather than data exfiltration or system compromise. No EPSS score was provided, no KEV listing exists, and no POC has been identified, placing this in the lower-priority tier for most organizations. Environments with high-risk authenticated user populations - shared hosting, university networks, or VPN endpoints with external users - face elevated practical risk relative to standard enterprise deployments.

An authenticated attacker - such as a domain user, VPN client, or low-privilege service account - sends a specially crafted TLS message or handshake sequence to a Schannel-exposed service (e.g., RDP or IIS) on an affected Windows host. The malformed input traverses a code path that dereferences a null pointer, triggering an access violation that crashes the service process. The result is disruption of the targeted TLS-dependent service; no exploit code is publicly known at this time.