Windows Kernel CVE-2026-85850

Exploitation requires the attacker to already possess local, low-privileged (authorized/authenticated, per PR:L) code-execution on an affected host - Windows 11 version 26H1 at builds from 10.0.28000.0 up to (not including) 10.0.28000.3231. No user interaction, no special feature toggle, and no non-default configuration is needed; any standard interactive or service account able to run code against the kernel can attempt it. The limiting factors are the mandatory prior foothold (AV:L) and low-privilege authentication requirement, which exclude purely remote or fully unauthenticated attackers; patched builds (>=10.0.28000.3231) are not affected.

This is a genuine patch-priority elevation-of-privilege issue, though not an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local, low-complexity attack that requires the attacker to already hold low privileges (PR:L) on the target, with full confidentiality, integrity, and availability impact once triggered - the classic profile of a kernel privilege-escalation primitive used as the second stage after initial access. CWE-763 (release of invalid pointer/reference) in the Windows Kernel typically yields a controllable memory-corruption primitive suitable for reliable SYSTEM-level escalation. Countervailing signals: no EPSS score was provided, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced, so this is 'no public exploit identified at time of analysis' rather than active exploitation. The requirement for existing local code execution (AV:L, PR:L) meaningfully limits real-world risk compared to a remote unauthenticated flaw. Note a data conflict: the input Tags label this 'Information Disclosure,' but the description and vector (I:H/A:H, 'elevate privileges') clearly indicate elevation of privilege, not disclosure - treat the tag as mislabeled. Net: prioritize patching on multi-user, shared, and endpoint systems where untrusted users can run code, but it is not a drop-everything remote threat.

An attacker who has already gained low-privileged code execution on a Windows 11 (26H1) host - for example via phishing, a malicious application, or a compromised standard user account - triggers the invalid-pointer release in the Windows Kernel to corrupt kernel memory and escalate to SYSTEM. No user interaction is needed and attack complexity is low, but prior local access is a prerequisite. No public proof-of-concept exploit was identified at the time of analysis.