Windows Win32 Kernel EUVD-2026-100028

Exploitation requires physical access to the target device (CVSS AV:P) - the attacker must be able to interact directly with the machine's hardware or local console rather than over any network. Within that constraint, no authentication is required (PR:N) and no user interaction is needed (UI:N), and the attack complexity is low (AC:L), so once physical access is obtained, exploitation against affected Windows builds is straightforward. The decisive limiting factor is the physical-access prerequisite, which confines realistic risk to insiders, shared/kiosk endpoints, or lost/stolen devices rather than remote attackers. Affected systems are Windows 10 (1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2019/2022/2025 below the patched build numbers listed in EUVD-2026-100028.

This is a genuinely moderate-priority issue rather than a top-tier emergency, and the signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 6.8) is capped at MEDIUM severity specifically because the attack vector is physical (AV:P) - an attacker must have hands-on access to the device, which sharply limits scalability despite the total CIA impact of a successful privilege escalation. CISA's SSVC decision data reinforces this: Exploitation is 'none' (no observed exploitation), Automatable is 'no' (physical access cannot be scripted or wormed at scale), and Technical Impact is 'total' (consistent with the C:H/I:H/A:H kernel-level compromise). The vulnerability is NOT in CISA KEV and no POC is referenced in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' There is no EPSS score in the input to weigh, so widespread-exploitation probability cannot be quantified here. The honest bottom line: a high technical impact (kernel heap overflow → full elevation of privilege) gated behind a physical-access precondition that makes it a targeted/insider or lost-device concern rather than a remote-mass-exploitation threat. Patch promptly on a normal cadence; it does not warrant emergency out-of-band response absent a change in exploitation status.

An attacker with physical access to an unlocked or accessible Windows machine (e.g., an insider, or someone handling a lost/stolen/kiosk/shared device) triggers a crafted input to the Win32 kernel subsystem that overflows a heap buffer (CWE-122), corrupting kernel memory to escalate from an unauthorized context to SYSTEM-level privileges. No public exploit code is identified in the provided data, and the physical attack vector (AV:P) means the attack cannot be performed remotely or automated at scale.