Windows Kernel CVE-2026-88141

Requires the attacker to already possess local, authenticated low-privileged code execution on the target Windows system (PR:L, AV:L) - remote exploitation is not possible. No user interaction is needed (UI:N), but the high attack complexity (AC:H) reflects a use-after-free race condition in the kernel that must be won, meaning exploitation may be unreliable and require repeated attempts or specific timing/memory-grooming conditions. No special non-default product feature or configuration is named in the description; any supported, unpatched Windows build in the affected ranges (Windows 11 23H2/24H2/25H2/26H1/26H2 and Windows Server 2022/2025 below the listed fixed builds) is susceptible once local access is obtained.

This is a credible but not top-tier priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0 HIGH) describes a local-only use-after-free requiring an already-authenticated low-privileged attacker and a high-complexity trigger - consistent with a kernel race condition that is not reliably exploitable on every attempt. Multiple signals agree that this is NOT an imminent, mass-exploitation threat: CISA's SSVC framework records Exploitation=none and Automatable=no (while rating Technical Impact=total, reflecting full kernel compromise if achieved), the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced. EPSS data was not provided in the input, so probabilistic exploitation likelihood cannot be factored in. The signals are internally consistent - high technical impact but low/absent exploitation evidence and high attack complexity - so this reads as a genuinely dangerous-if-exploited local EoP that is currently a patch-on-normal-cycle item rather than an emergency. Note the 'Denial Of Service' tag sits alongside C:H/I:H/A:H full-impact metrics; the primary documented impact is local privilege elevation, not merely DoS.

An attacker who already has a low-privileged foothold on a Windows host (e.g., via a compromised standard user account or a sandboxed process) runs a local program that manipulates a vulnerable kernel object to trigger the use-after-free, winning a race condition to corrupt kernel memory and execute code at SYSTEM level. No public exploit code is identified at time of analysis, and the high attack complexity means the trigger may require multiple attempts to succeed.