Windows Kernel CVE-2026-88134

Exploitation requires the attacker to already have authenticated, low-privileged local code execution on the target Windows system (CVSS PR:L, AV:L) - this is a local privilege-escalation flaw, not remotely reachable. No user interaction is required (UI:N). The limiting factors are substantial: the attacker needs an existing foothold on the host, exploitation is not automatable per CISA SSVC, and the target must be an unpatched build below the fixed versions (e.g., Windows 11 24H2 below 10.0.26100.9711, Windows Server 2025 below 10.0.26100.33650, down through legacy Server 2012/2012 R2 builds). The use-after-free affects the core Windows Kernel, so no special feature or non-default configuration is needed beyond running a vulnerable, unpatched Windows version.

This is a genuine but moderate-priority issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms local exploitation requiring the attacker to already hold low-level privileges on the host, which caps the base score at 7.8 (High) despite total C/I/A impact. CISA's SSVC framework reinforces a lower urgency: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be reliably scripted at scale), with only Technical Impact=total being severe - consistent with a local elevation-of-privilege primitive rather than a remote mass-exploitation threat. There is no KEV listing and no public POC reported, and no EPSS score was provided in the input, so exploitation probability cannot be quantified. In short, the signals are internally consistent and point to a post-compromise privilege-escalation tool: high impact if an attacker already has a foothold, but not automatable and not currently exploited. No conflicting signals were found; the main gap is the absence of EPSS data to gauge near-term exploitation likelihood.

An attacker who already has low-privileged code execution on a Windows host (e.g., via phishing, a malicious local app, or a compromised standard user account) triggers the use-after-free in the Windows Kernel to corrupt kernel memory and elevate to SYSTEM. No public exploit code has been identified at time of analysis, and no user interaction by another party is required. This would typically be chained as the second stage after an initial-access vulnerability.