Windows Kernel CVE-2026-96915

Exploitation requires the attacker to already have authenticated local access with at least low privileges (CVSS PR:L) on the target Windows system and the ability to execute code that reaches the vulnerable kernel-mode driver interface; there is no remote or network path (AV:L) and no user interaction is needed (UI:N). The limiting factors are therefore the need for an existing local foothold and valid (even low-privileged) credentials or a running process context - this is a second-stage escalation primitive, not a standalone remote entry point. No special non-default product configuration is identified in the available data; the affected component is a standard Windows kernel driver present across the listed client and server builds.

This is a credible, patch-now local privilege escalation rather than a hypothetical issue, but it is not an internet-facing emergency. The CVSS 3.1 base of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) tells a consistent story: an attacker who already has a foothold with low privileges (PR:L) can, with low complexity and no user interaction, integer-overflow a Windows kernel-mode driver (CWE-190) to gain full confidentiality, integrity and availability impact - i.e. SYSTEM-level code execution. The signals do not conflict with the description: both point to local, authenticated, kernel EoP. However, several key triage signals are MISSING from the input: no EPSS probability was provided, there is no CISA KEV listing, and no POC/exploit-code indicator is present, so exploitation status is 'no public exploit identified at time of analysis'. Because kernel EoP bugs are classic second-stage tools (chained after initial access or in sandbox escapes) and this affects the near-universal Windows platform, it warrants prompt patching despite the local-only vector - but absent EPSS/KEV data there is no evidence of active or widespread exploitation, so it should be prioritized as a standard Patch-Tuesday-class kernel EoP rather than an actively-exploited zero-day.

An attacker who has already obtained a low-privileged foothold on a Windows host - via phishing, a compromised service account, or a sandboxed/second-stage payload - invokes the vulnerable kernel-mode driver with crafted input that triggers an integer overflow. The overflow corrupts kernel memory in a way that yields SYSTEM-level execution, completing a local escalation of privilege. No public exploit code is identified at time of analysis, and because the CVSS vector is AV:L, the attacker must already be able to run code locally with PR:L privileges.