Windows 11 CVE-2026-96849

Exploitation requires an attacker to already possess a local, authenticated low-privilege session on the affected host (AV:L/PR:L) and to interact directly with the vulnerable Windows kernel-mode driver interface; no user interaction by a victim is needed (UI:N). The flaw affects Windows 11 version 26H1 builds from 10.0.28000.0 up to (but not including) the fixed 10.0.28000.3231. Limiting factors: there is no remote vector, an attacker foothold with existing privileges is mandatory, impact is confined to information disclosure (no code execution or modification), and the leaked data is uninitialized kernel memory whose usefulness depends on what residual content happens to be present - making reliable, targeted extraction non-trivial.

This is a moderate-severity local information disclosure issue that signals should NOT be over-prioritized despite affecting a ubiquitous platform. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) is internally consistent: exploitation requires local access and existing low-level privileges (PR:L, i.e. an authenticated foothold), with only confidentiality impacted (C:H, no integrity or availability effect). All three real-world exploitation signals agree and are LOW: CISA SSVC reports Exploitation=none, Automatable=no, and Technical Impact=partial, which aligns with the local, privilege-required nature. There is no CISA KEV listing and no public proof-of-concept. EPSS was not provided in the input, so probabilistic exploitation likelihood cannot be quantified. The signals do not conflict - a CWE-908 uninitialized-resource leak in kernel-mode drivers typically yields fragments of kernel memory (useful mainly as a building block, e.g. for KASLR bypass, rather than a standalone compromise). Net: a legitimate patch-management item, but a low operational priority relative to remote or unauthenticated flaws; it matters most as an aid to local privilege-escalation chains.

An attacker who already has a low-privileged authenticated session on a Windows 11 host runs a crafted program that invokes the affected kernel-mode driver interface, causing it to return uninitialized kernel memory. The leaked bytes expose kernel addresses or residual data useful for defeating ASLR or as a stepping stone in a local privilege-escalation chain. No public exploit code is identified at time of analysis, and exploitation requires local access plus existing privileges (AV:L/PR:L).