Windows Win32 Kernel CVE-2026-85804

Requires the attacker to already have authenticated local code-execution ability on the target host as a low-privileged user (PR:L, AV:L) - this is a post-foothold escalation, not remotely reachable. No user interaction is needed (UI:N) and the flaw reportedly affects default installations of the listed Windows 11 builds (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025 (including Server Core) at kernel level, so no special feature toggle is documented as a prerequisite. The primary limiting factor is the local-access and prior-privilege requirement; successful exploitation also depends on winning the use-after-free race/object-reuse condition in the Win32 kernel subsystem.

This is a credible but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U, 7.8 High) is internally consistent for a kernel use-after-free: it requires local access and existing low-level privileges (PR:L - an 'authorized attacker' per the description), with no user interaction, yielding full confidentiality, integrity, and availability impact within the same security scope (S:U), which is the expected profile for a successful privilege-escalation primitive. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation or widespread automated attack at time of analysis - this is a real but targeted/post-compromise concern rather than a perimeter-breaking issue. The key limiting signal is that exploitation is local and requires pre-existing authenticated access, so it is most relevant as a second-stage escalation after an attacker already has a foothold. Note a metadata inconsistency: the description and impact profile describe local privilege elevation, yet the input Tags include 'Denial Of Service' - the A:H component could be read as DoS, but the primary documented impact is EoP, so treat the DoS tag with caution.

An attacker who already has low-privileged code execution on a Windows host (for example via phishing, a malicious installer, or a compromised standard user account) runs a crafted program that triggers the use-after-free in the Win32 kernel subsystem to corrupt kernel memory. By grooming the freed object and reusing the dangling reference, they gain SYSTEM-level privileges, escalating from a limited user to full control of the machine. No public exploit code is identified in the provided data, so this scenario assumes attacker-developed tooling.