Windows Kernel CVE-2026-85836

Exploitation requires the attacker to already have authenticated, low-privileged local access to the target Windows host (PR:L, AV:L) - remote exploitation is not possible. No user interaction is required (UI:N) and attack complexity is low (AC:L). Affected builds include Windows 11 (24H2/25H2/26H1/26H2) and Windows Server 2025, below the patched kernel build numbers listed in the EUVD data (e.g. Windows 11 24H2 before 10.0.26100.9711, Windows Server 2025 before 10.0.26100.33650); fully patched systems are not exploitable. The primary limiting factor is the need for a pre-existing local foothold, which makes this a post-compromise escalation step rather than an initial-access vector.

This is a locally-exploitable Windows Kernel use-after-free (CWE-416) rated CVSS 7.8. The provided CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates an authorized attacker with low privileges can achieve full confidentiality, integrity and availability impact on the local system with low attack complexity and no user interaction - a classic privilege-escalation primitive. No EPSS score was supplied, the CVE is NOT present in CISA KEV, and no public POC is referenced, so there is no evidence of active or widespread exploitation at this time. The signals are therefore internally consistent and non-conflicting: a serious but not network-reachable flaw that requires an attacker to already have a foothold (valid local account / code execution) before it is useful. Priority should be driven by Windows' ubiquity and the fact that EoP bugs are common post-compromise building blocks, rather than by any exploitation-probability signal, which is currently absent. Note the input Tags include 'Denial Of Service' while the description describes elevation of privilege; the A:H metric partially supports a DoS outcome, but the primary impact per Microsoft is privilege escalation - treat the DoS label with caution.

An attacker who has already gained low-privileged code execution on a Windows host (e.g. via phishing, a malicious application, or a compromised standard user account) triggers the use-after-free in the Windows Kernel to corrupt kernel memory and elevate to SYSTEM. No user interaction is required and attack complexity is low. No public exploit code is identified at time of analysis, so this would require the attacker to develop or obtain a working exploit.