Windows Kernel CVE-2026-85802

Exploitation requires the attacker to already possess local, authenticated access to the target host as at least a low-privileged user (PR:L) - there is no remote or network vector (AV:L) and no user interaction is needed (UI:N). The key limiting factor is high attack complexity (AC:H): use-after-free exploitation in the Win32 kernel subsystem typically depends on winning a timing/race condition and successfully reclaiming and grooming the freed kernel object, which is not reliably reproducible on every attempt. All currently supported Windows client and server builds below the patched versions listed in EUVD-2026-99513 (e.g., Windows 11 24H2 <10.0.26100.9711, Windows Server 2025 <10.0.26100.33650, Windows 10 22H2 <10.0.19044.7807) are affected in default configurations; no special feature enablement is cited, so the limiting factors are the prerequisite local foothold and the race reliability rather than a non-default setting.

This is a moderate-priority local privilege escalation driven by a use-after-free (CWE-416) in the Windows Win32 kernel subsystem. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U) confirms the attacker must already have local, authenticated low-privilege access and must win a non-trivial condition (AC:H) - consistent with the race windows typical of kernel UAF bugs - before achieving the full C:H/I:H/A:H impact of SYSTEM-level compromise. No EPSS score, SSVC decision, KEV listing, or POC was provided, so there is no positive signal of real-world exploitation: this is best treated as no public exploit identified at time of analysis. The 7.0 base score is a genuine 'High' but is held down from critical precisely by the local access requirement and high attack complexity, so it is not an internet-facing emergency. The realistic concern is as a second-stage escalation primitive after an attacker already has code execution on the host (e.g., post-phishing or chained with an RCE). Note the input Tags include 'Denial Of Service' while the description describes only privilege elevation - the A:H impact can manifest as a bugcheck/DoS, but the authoritative impact is EoP; treat the DoS tag as a secondary, memory-corruption-derived characterization rather than the primary outcome.

An attacker who already has a low-privileged foothold on a Windows host (e.g., a standard user account gained via phishing or a prior exploit) runs a crafted local program that triggers the use-after-free in the Win32 kernel subsystem. By winning the race/timing condition (AC:H) and grooming the freed kernel object, they corrupt kernel memory to execute code as SYSTEM and fully take over the machine. No public exploit code was identified at time of analysis.