Windows Kernel EUVD-2026-100342

Requires local, authenticated access with at least a low-privileged account (CVSS PR:L) and the ability to execute code on the target Windows host to invoke the vulnerable kernel path; no user interaction is needed (UI:N). There is no network vector (AV:L) and no special non-default configuration is called out - the flaw is in the Windows Kernel itself, so default installations of the listed builds are affected. Exploitation is limited by the need for prior code execution/credentials on the machine and yields only information disclosure (C:H, I:N, A:N), not direct code execution or system compromise, making it most useful as one link in a larger local attack chain. Affected builds span Windows 10/11 (multiple versions), Windows Server 2012 through 2025, and Server Core installations, each fixed in the vendor-specified build.

This is a moderate-severity local information disclosure flaw (CVSS 5.5) in the Windows Kernel stemming from use of an uninitialized resource (CWE-908). The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N is internally consistent with the description's 'authorized attacker ... discloses information locally': AV:L confirms local-only reach and PR:L confirms an authenticated low-privileged account is required, so this is NOT remotely exploitable. The only elevated metric is C:H (high confidentiality impact) - reflecting disclosure of potentially sensitive uninitialized kernel memory (e.g., pointers/addresses useful for defeating KASLR) - while I:N and A:N confirm no integrity or availability impact. On exploitation signals, no EPSS score, no CISA KEV entry, and no public POC were provided, so exploitation likelihood indicators are absent rather than conflicting: this is 'no public exploit identified at time of analysis.' A vendor patch is available. Net assessment: despite affecting a ubiquitous product, the local access requirement, authentication prerequisite, and disclosure-only (no code execution) impact make this a routine patch-cycle item rather than an emergency - more valuable as a chained primitive (info leak feeding a separate privilege-escalation or RCE exploit) than as a standalone threat. No KEV or EPSS data is present to indicate active or widespread exploitation.

A low-privileged but authenticated user (or malware already running under a standard user account) executes crafted code that invokes the vulnerable Windows Kernel path, causing it to return uninitialized memory contents. The leaked bytes may expose kernel addresses or residual sensitive data that the attacker then uses to bypass KASLR and strengthen a separate local privilege-escalation chain. No public exploit code is identified at time of analysis, and the attack requires local access and valid credentials.