Windows Kernel CVE-2026-96249

Exploitation requires the attacker to already possess local, authenticated low-privileged access to the Windows host (CVSS PR:L, AV:L) - there is no remote or network vector. No user interaction is needed (UI:N). The attacker must be able to invoke the affected Win32 kernel subsystem code path and win the use-after-free timing to corrupt kernel memory; the input provides no evidence of a non-default configuration requirement, so default installations of the listed builds are in scope. Limiting factors: the need for prior local access, the per-attempt reliability inherent to UAF exploitation (SSVC Automatable: no), and the requirement that the host run an unpatched affected build (Windows 11 24H2/25H2/26H1/26H2 or Windows Server 2025 below the fixed revisions).

This is a credible but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local privilege-escalation flaw requiring the attacker to already have low-privileged authenticated access to the host - it is not remotely exploitable. The signals are consistent and point AWAY from imminent mass exploitation: CISA's SSVC decision framework lists Exploitation as 'none' (no observed or public exploitation), Automatable as 'no' (expected, since local EoP cannot be sprayed across the internet), while Technical Impact is 'total' (matching the C:H/I:H/A:H full-system compromise once triggered). No EPSS score was provided in the input, and there is no CISA KEV listing and no public exploit. The chief risk is as a post-compromise building block: a UAF in the Win32 kernel subsystem (CWE-416) is a classic target for chaining after initial access to reach SYSTEM. Given Windows' ubiquity and Microsoft's own reporting of the flaw, patching should be prioritized on multi-user and internet-facing hosts, but the absence of exploitation signals means this is a 'patch in normal cadence' item rather than a drop-everything KEV-style threat.

An attacker who has already gained low-privileged code execution on a Windows host - for example via phishing, a malicious document, or a compromised standard user account - triggers the use-after-free in the Win32 kernel subsystem to corrupt kernel memory and elevate to SYSTEM. No public exploit code has been identified at time of analysis, and the SSVC framework reports no known exploitation, so this would currently require custom exploit development against the specific UAF condition.