Windows Kernel CVE-2026-83796

Exploitation requires the attacker to already have local, authenticated low-privileged access to the target host (CVSS PR:L, AV:L) - i.e. the ability to run code as a standard/limited user. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once local foothold exists the use-after-free can be triggered against default Windows Kernel behavior without special configuration. The primary limiting factor is the local-access prerequisite: this flaw cannot be exploited remotely or without prior code execution on the machine, which substantially narrows realistic exploitation to post-compromise privilege escalation, sandbox escape, or malicious local applications. Fixed in builds Windows Server 2025 10.0.26100.33650, Windows 11 24H2 10.0.26100.9711, 25H2 10.0.26200.9711, 26H2 10.0.26300.9711, and 23H2 10.0.22631.7652.

This is a locally-exploitable privilege-escalation flaw (CWE-416 use-after-free) in the Windows Kernel with a CVSS 3.1 base of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The signals point consistently toward a credible-but-not-urgent priority: the CVSS vector requires local access and some privilege (PR:L), meaning the attacker must already have authenticated/low-privileged code execution on the host - this is a second-stage escalation primitive, not an initial-access or remotely-wormable bug. CISA's SSVC framework reinforces this: Exploitation=none (no observed exploitation), Automatable=no (cannot be reliably mass-exploited), yet Technical Impact=total (full kernel compromise if exploited). There is no KEV listing and no EPSS score in the provided data, and no public exploit code was referenced, so there is no current evidence of real-world weaponization. The combination - total technical impact but no automation and no observed exploitation - is typical of Microsoft Patch-Tuesday kernel EoP bugs that are valuable to attackers already on a machine (ransomware post-compromise, sandbox escape) but do not drive internet-wide scanning. Net: patch on a normal prioritized cycle (prioritize on systems where untrusted users run code), but this is not a drop-everything network-facing emergency. Note one metadata inconsistency to verify: the Tags include 'Denial Of Service' alongside the EoP description; the A:H impact makes a DoS secondary effect plausible, but the primary advertised impact is privilege elevation.

An attacker who has already gained low-privileged code execution on a Windows host - for example via a phishing payload, a malicious local application, or a compromised standard user account - triggers the use-after-free condition in the Windows Kernel to corrupt kernel memory and elevate to SYSTEM. No user interaction is required once local access is obtained. No public exploit identified at time of analysis, so weaponization would require independent exploit development.