Windows Kernel EUVD-2026-100032

Requires an authenticated local user already able to execute code on the Windows host (PR:L, AV:L) - remote and unauthenticated attack is not possible. The flaw resides in the Win32 Kernel Subsystem and the CVSS AC:H rating indicates a non-default, hard-to-meet condition (such as winning a race or hitting a specific memory/timing state) that the attacker does not control, which materially limits reliable exploitation. No user interaction is needed (UI:N). Impact is limited to disclosure of sensitive system information (C:H); there is no integrity or availability impact (I:N/A:N). Patched builds are available for all listed Windows client and server versions, so unpatched systems are the only exposed population.

This is a genuinely low-priority, moderate-severity issue despite affecting a ubiquitous platform. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, base 4.7 Medium) describes a local information-disclosure flaw requiring an already-authenticated local user and high attack complexity, with only confidentiality impact. All exploitation signals point the same direction and are mutually consistent: SSVC reports Exploitation=none, Automatable=no, and Technical Impact=partial, which aligns with the Medium CVSS and the local, high-complexity nature. There is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided in the input (absence noted, not treated as an error). The AC:H metric implies a non-trivial precondition such as a race condition or timing/memory-state dependency that reduces reliable exploitability. Net: this is a high-CVSS-platform but low-real-risk issue - a defense-in-depth patch, not an emergency. No signals conflict; the only genuinely missing datum is EPSS probability.

A low-privileged but authenticated local user on a Windows host runs a crafted program that interacts with the Win32 kernel subsystem under specific timing or state conditions, causing the kernel to leak sensitive system information (e.g., kernel memory contents or address data) into a sphere the attacker can read. No public exploit code has been identified, and the high attack complexity means the attacker must win a race or hit a narrow condition to succeed. The disclosed data could aid subsequent local privilege-escalation attacks by defeating kernel address-space protections.