Windows Win32 Kernel EUVD-2026-100236

Exploitation requires the attacker to already possess authenticated low-privileged local code execution on the target Windows system (AV:L, PR:L) - this is not remotely reachable and requires no victim interaction (UI:N). The core limiting factor is the race condition itself: as a TOCTOU flaw (CWE-367) the attacker must reliably win a narrow timing window between the kernel's check and use of a resource, which the AC:H rating and SSVC 'Automatable: no' confirm is difficult and non-deterministic, likely needing many attempts. Impact is confined to information disclosure (C:H) with no integrity or availability effect, so the realistic payoff is leaked kernel data rather than direct compromise. The specific vulnerable Win32 kernel code path is not named in the available data, so no particular feature or configuration setting can be cited as a prerequisite; it applies to default configurations of the listed in-support Windows versions below the patched build numbers.

This is a genuinely low-priority issue despite being a kernel vulnerability. The CVSS 3.1 score of 4.7 (Medium) is driven by AV:L (local access required), AC:H (high complexity - winning the TOCTOU race window is non-deterministic), PR:L (the attacker must already have a low-privileged authenticated foothold), and an impact limited strictly to confidentiality (C:H/I:N/A:N) with no scope change (S:U). All signals converge toward low real-world risk rather than conflicting: CISA's SSVC framework rates Exploitation as 'none', Automatable as 'no' (consistent with the race condition that makes AC:H appropriate), and Technical Impact as only 'partial'. There is no CISA KEV listing and no public POC in the provided data, so there is no public exploit identified at time of analysis. No EPSS score was supplied, so quantitative exploitation probability cannot be stated. The one consistency check worth noting: the description says 'disclose information locally' and the vector's AV:L agrees - there is no network/local contradiction here. Net assessment: a defense-in-depth kernel info-disclosure bug most valuable as one link in a larger local exploit chain (e.g., defeating KASLR), not a standalone priority. Patch during normal cycles.

An attacker who already has the ability to run low-privileged code on a Windows host (e.g., via a standard user account or a compromised low-integrity process) repeatedly triggers the vulnerable Win32 kernel operation to win a narrow time-of-check/time-of-use race window. On a successful race they read kernel memory contents that should be inaccessible, potentially leaking addresses or data useful for a subsequent privilege-escalation chain. The AC:H rating reflects that success is probabilistic and may require many attempts; no public exploit code is identified at time of analysis.