Windows Kernel CVE-2026-85871

Exploitation requires the attacker to already possess authenticated low-privileged local code execution on the target Windows system (CVSS PR:L, AV:L) - there is no remote or network-facing attack surface. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once local access is obtained the overflow is reliably triggerable against default configurations without special feature enablement; the description names no optional configuration or non-default mode, meaning standard installations of the listed Windows 10/11 and Windows Server 2012-2025 builds (below the EUVD-specified patched versions) are affected. The primary limiting factor is the mandatory prior foothold and valid local privileges, which confines this to post-compromise privilege escalation rather than initial access.

This is a locally-exploitable privilege escalation flaw with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N), meaning an attacker must already have authenticated low-privilege code execution on the host before leveraging it - it is not a remote entry point. All signals point to a secondary, post-compromise escalation primitive rather than an urgent perimeter threat: CISA's SSVC decision framework records Exploitation as 'none' and Automatable as 'no', and there is no CISA KEV listing and no public exploit identified at time of analysis. The one signal that elevates concern is SSVC Technical Impact = 'total', consistent with the CVSS C:H/I:H/A:H and the kernel-mode context (SYSTEM-level compromise if exploited). The signals are internally consistent - low real-world exploitation pressure today, but high impact if weaponized - so this is a solid patch-management priority (especially on multi-user or shared Windows hosts where local attackers are plausible) rather than a drop-everything emergency. No EPSS score was provided in the input, so probabilistic exploitation likelihood could not be factored in and should be checked separately.

An attacker who has already gained low-privileged code execution on a Windows machine (e.g., via phishing, a compromised user account, or a prior exploit) runs a crafted program that sends malformed input to a vulnerable kernel-mode driver, triggering a heap-based buffer overflow (CWE-122) in kernel memory. By corrupting kernel heap structures they overwrite control data to execute code at SYSTEM/kernel level, escalating from a standard user to full machine control. No public proof-of-concept exploit has been identified at time of analysis, and the CVSS AC:L indicates the overflow is reliably triggerable once local access exists.