Windows Kernel CVE-2026-85360

The attacker must hold a low-privileged local account on the target Windows system (PR:L); remote unauthenticated exploitation is not possible given AV:L. The high attack complexity (AC:H) implies the exploit requires winning a race condition or achieving a specific kernel object lifecycle state, meaning exploitation is not trivially reliable and may require multiple attempts. No special Windows feature, service, or non-default configuration is identified in the available data - the vulnerable code path appears to exist in a general-purpose kernel component present across all affected editions in their default installation. Exploitation is limited to local access: network-only access without local login does not satisfy the attack vector.

The 7.0 CVSS score reflects genuine exploitation friction: AC:H indicates a race condition or specific kernel state must be won, and PR:L means the attacker must already hold a valid local account. The post-exploitation impact is maximal (C:H/I:H/A:H), making the flaw highly attractive to malware, ransomware, and APT toolchains that frequently chain local privilege escalation with initial access vectors to achieve full system control. EPSS data was not supplied, and the vulnerability is not listed in CISA KEV, suggesting no confirmed widespread exploitation at time of analysis. No public proof-of-concept has been identified. Organizations with large, mixed-version Windows estates - particularly those running legacy Server 2012/2016 endpoints still in extended support - face the most residual risk, as unpatched kernel-level EoP flaws of this class are routinely weaponized within weeks of patch release. The 'Denial of Service' tag applied to this record is misleading: the primary impact is privilege escalation; DoS is a secondary consequence of memory corruption, not the headline risk.

An attacker with an unprivileged Windows local account (e.g., obtained via phishing or a web-browser renderer escape) triggers a race condition in the Windows Kernel that causes a kernel object to be freed while a reference is retained, then reallocates the freed region with crafted data to redirect kernel execution. This yields SYSTEM-level code execution, enabling the attacker to disable security tools, dump credentials from LSASS, or install a persistent kernel-mode implant. No public proof-of-concept has been identified, but the attack class is well-understood and tooling for Windows kernel UAF exploitation is widely available in offensive frameworks.