Windows Kernel-Mode Drivers EUVD-2026-100010

Exploitation requires the attacker to already possess local, authenticated low-privileged code-execution on the target Windows system (CVSS PR:L, AV:L) - there is no remote or network-reachable path. No user interaction is needed (UI:N) and no special or non-default product feature must be enabled; the vulnerable kernel-mode driver ships and runs by default on all affected Windows client and server builds listed in EUVD-2026-100010 (Windows 10 1607/1809/21H2/22H2, Windows 11 23H2, and Windows Server 2012 through 2025). The primary limiting factor is the prerequisite local foothold; the absence of a network vector and SSVC Automatable=no mean it cannot be mass-exploited remotely, so realistic abuse is as a post-access escalation step on already-breached or multi-user hosts.

This is a credible but not emergency-tier patching priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local privilege-escalation flaw in Windows Kernel-Mode Drivers requiring an attacker to already hold low-level authenticated access on the host, with low attack complexity and no user interaction, yielding total loss of confidentiality, integrity and availability - consistent with a kernel-to-SYSTEM elevation. Multiple signals agree that real-world risk is moderate rather than acute: CISA's SSVC decision framework reports Exploitation=none and Automatable=no (as expected for a local EoP that cannot be fanned out via scanning/worming), while rating Technical Impact=total, matching the C/I/A:H impact set. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis. The practical risk is that EoP bugs like this are commonly chained as a post-compromise step after initial access (phishing, commodity malware, a foothold on a shared or RDP host); they are valuable to attackers but depend on prior access. CONFLICTING METADATA: the input Tags include 'Information Disclosure,' but the description and CWE/impact profile describe privilege elevation, not information disclosure - treat the tag as unreliable and the flaw as EoP.

An attacker who already has a low-privileged authenticated session on a Windows host (e.g., a standard user after a phishing-delivered foothold or on a shared terminal/RDP server) runs a crafted local program that abuses the improper access control in a kernel-mode driver to elevate to SYSTEM. No user interaction is required and attack complexity is low, but code must execute locally on the target. No public exploit was identified in the provided data.