Windows Kernel CVE-2026-83735

Exploitation requires the attacker to already have local, authenticated access as a low-privileged user (PR:L) with the ability to execute code on the target Windows host; it cannot be triggered remotely or by an unauthenticated actor. No user interaction is needed (UI:N) and complexity is low (AC:L), and it affects default configurations of the kernel on supported Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025 builds below the patched versions (e.g., 24H2 < 10.0.26100.9711, Server 2025 < 10.0.26100.33650). The primary limiting factor is the local-access prerequisite: this is a privilege-escalation step usable only after an initial foothold, and applying the available Microsoft patch removes the condition.

This is a locally-exploitable Windows Kernel elevation-of-privilege flaw (CWE-763, release of invalid pointer/reference) with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The signals are internally consistent and point to a moderate-but-real priority rather than an emergency. The CVSS vector confirms local attack vector, low complexity, and that the attacker must already hold at least low-privilege (PR:L) authenticated access - so this is a post-compromise privilege-escalation primitive, not a remote entry point. Corroborating this, CISA's SSVC assessment lists Exploitation: none (no observed or public exploitation), Automatable: no (consistent with requiring an existing foothold and local execution), and Technical Impact: total (consistent with kernel-level C:H/I:H/A:H full SYSTEM compromise). There is no CISA KEV listing and no EPSS score supplied; absence of these is not evidence of safety but does lower immediate urgency. The one conflicting signal is metadata, not substance: the input Tags include 'Information Disclosure,' which contradicts the description (local privilege elevation) and the CVSS impact profile (full C/I/A, scope unchanged) - this appears to be a mislabeled category and should be read as Elevation of Privilege. Overall: a credible kernel LPE worth routine patch-cycle prioritization on Windows fleets, elevated because kernel bugs are reliable chaining targets, but not a drop-everything issue absent any exploitation or POC signal.

A low-privileged user or a process already running on the host (e.g., after phishing, a browser compromise, or a foothold on a shared/RDP server) triggers the invalid pointer release in the Windows Kernel to corrupt kernel memory and elevate to SYSTEM. No user interaction is required and attack complexity is low, but the attacker must first have local code execution as an authenticated low-privilege principal. No public exploit identified at time of analysis, so weaponization would require independent development.