Windows Kernel EUVD-2026-100128

Exploitation targets the Windows Kernel and requires no authentication (PR:N) and no user interaction (UI:N), and is reachable over a network (AV:N) against the listed supported Windows client and server builds in their shipping configurations. The key limiting factor is high attack complexity (AC:H): the attacker must control or influence an untrusted pointer and satisfy specific conditions - such as winning a timing/race window or achieving a precise kernel memory layout - so exploitation is not a simple single-shot request and may require repeated attempts. Exposure is further bounded to hosts whose vulnerable kernel code path is actually network-reachable; whether a non-default service or listener must be enabled is not specified in the available data and should be confirmed with Microsoft.

This is a genuine high-priority patching candidate but not a drop-everything emergency based on currently available signals. The CVSS 3.1 base score of 8.1 is driven by a network attack vector (AV:N), no required privileges (PR:N), and no user interaction (UI:N), combined with total compromise of the kernel (C:H/I:H/A:H) - a successful attack yields SYSTEM-level control. The single most important mitigating signal is AC:H (high attack complexity), which indicates the attacker must win a race, groom kernel memory, or satisfy specific runtime conditions to control the untrusted pointer dereference (CWE-822); this materially lowers the probability of reliable, repeatable exploitation. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no evidence of active exploitation or weaponization at time of analysis - the risk is currently theoretical/reputational rather than observed. Two conflicts must be flagged: (1) the description states privilege elevation 'over a network,' which is semantically unusual because elevation-of-privilege flaws are typically local - verify with Microsoft whether this is a remote pre-auth kernel bug or a network-reachable service that bridges to kernel EoP; and (2) the input tag 'Authentication Bypass' does not match CWE-822 (Untrusted Pointer Dereference) or the described privilege-elevation impact, so that tag appears mislabeled and should not be used to scope detection.

A remote, unauthenticated attacker reachable to an affected Windows host sends specially crafted network input that causes the Windows Kernel to dereference an attacker-influenced (untrusted) pointer, corrupting kernel memory to gain SYSTEM privileges. Because CVSS specifies AC:H, the attacker must satisfy precise timing or memory-layout conditions, likely requiring multiple attempts before the dereference lands reliably. No public exploit code was identified in the provided intelligence.