Windows Kernel CVE-2026-96868

Exploitation requires the attacker to already possess local, authenticated low-privilege access to the target (PR:L, AV:L) - this is a privilege-escalation primitive, not a remote entry point, and cannot be triggered over the network or by luring a user to content. The high attack complexity (AC:H) indicates a further limiting factor: successful exploitation depends on manipulating or winning a race on kernel heap state, so it is not reliably triggerable on demand. Affected are unpatched builds of Windows 11 (24H2 <10.0.26100.9711, 25H2 <10.0.26200.9711, 26H2 <10.0.26300.9711) and Windows Server 2025 including Server Core (<10.0.26100.33650); patched builds are not exploitable. No special non-default feature or configuration is named in the description - the flaw is in the kernel itself, present by default.

This is a genuine but moderate-priority issue rather than an emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) describes a local privilege-escalation flaw: an attacker must already have low-privilege code execution on the host (PR:L) and the attack is high-complexity (AC:H), implying a race condition or specific timing/memory-state requirement typical of heap overflows in the kernel. Impact is severe once triggered - full C:H/I:H/A:H, i.e. SYSTEM-level compromise. No EPSS score, KEV listing, or POC indicator was supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the AC:H rating further suggests reliable weaponization is non-trivial. The main risk driver is prevalence: Windows Kernel is ubiquitous, so the affected surface is enormous and this is a standard patch-cycle priority (EoP chained after initial access). Signals are internally consistent - no conflicts between the vector and the 'elevate privileges locally' description. Key missing data: EPSS/KEV/POC are all absent, limiting confidence on real-world exploitation likelihood.

An attacker who has already obtained low-privileged code execution on a Windows host (e.g., via phishing, a compromised standard user account, or a sandboxed process) triggers the heap-based buffer overflow in the Windows Kernel to corrupt kernel memory and escalate to SYSTEM. The high attack complexity (AC:H) implies the exploit must win a race or manipulate specific heap state, so reliable exploitation requires skill. No public proof-of-concept was identified at time of analysis.