Windows Kernel CVE-2026-96913

Exploitation requires the attacker to already possess the ability to execute code as a low-privileged local user on the target Windows host (AV:L, PR:L) - there is no remote or network-triggerable path and no user interaction is needed (UI:N). The condition is simply running attacker-controlled code that reaches the vulnerable kernel allocation path; the description names no optional feature, service, or non-default configuration, so default installations of the listed Windows 10/11 and Windows Server 2019/2022/2025 builds below the patched versions are affected. The primary limiting factor is the local-access prerequisite: an attacker without an existing foothold cannot reach this bug directly, making it a post-compromise escalation rather than an initial-access vector.

This is a genuine prioritization candidate despite being a local-only flaw. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C) describes a low-complexity attack requiring only low existing privileges, no user interaction, and a scope change - the hallmark of a kernel privilege-escalation primitive that takes an attacker from a standard/limited user context to full SYSTEM/kernel control (C:H/I:H/A:H). The 8.8 base score is driven up by the scope change and triple-high impact rather than by remote reachability. No EPSS score, SSVC decision data, KEV entry, or POC indicator was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; exploitation probability cannot be quantified from the data given. Signals are internally consistent - nothing conflicts - but the picture is incomplete: the only reference is the Microsoft MSRC update-guide page, and there is no independent corroboration of exploitation likelihood. Realistically this is a high-value second-stage/post-compromise bug (chained after initial access) rather than an internet-facing emergency, but kernel heap overflows in Windows historically attract reliable weaponization, so it should be patched on a priority cycle.

An attacker who already has a foothold as a low-privileged local user (e.g., via phishing, a compromised service account, or a prior low-priv exploit) runs a crafted program that triggers the heap-based buffer overflow in the Windows Kernel. By corrupting kernel heap structures they elevate to SYSTEM/kernel privileges, enabling full host takeover. No public proof-of-concept was identified in the provided data, and the local attack vector (AV:L) means the attacker must first be able to execute code on the target.