Windows Kernel EUVD-2026-100391

Exploitation requires physical access to the target device (CVSS AV:P) - the attacker must be able to interact with the machine locally to run code that feeds an untrusted pointer into the vulnerable Windows Kernel path; it cannot be performed over a network. No authentication is required (PR:N) and no special non-default feature or configuration is named in the description, so default installations of Windows 11 version 26H1 (builds 10.0.28000.0 up to the fixed 10.0.28000.3231) are affected. The primary limiting factor is the physical-access prerequisite, which confines realistic risk to scenarios such as lost, stolen, unattended, or shared/kiosk hardware rather than remote mass exploitation; applying the available Microsoft update remediates it.

The CVSS 3.1 base score of 6.8 (Medium) is driven down from what would otherwise be a critical-impact flaw (C:H/I:H/A:H) by the physical attack vector (AV:P), which is the single most important risk-limiting signal here. Attack complexity is low and no privileges or user interaction are required (AC:L/PR:N/UI:N), so once an attacker has hands-on access to the device, exploitation is straightforward and yields full compromise with scope unchanged (S:U). No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization at this time - consistent with physical-access EoP bugs, which are rarely mass-exploited and instead matter for targeted scenarios (lost/stolen/seized devices, evil-maid attacks, kiosk/shared hardware). This is therefore a real but situational priority: patch it as part of normal Windows servicing, but it is not an emergency remote threat. Note two data caveats: the input Tag 'Authentication Bypass' conflicts with the description and CWE-822 (untrusted pointer dereference leading to privilege elevation) - this appears mislabeled; and no EPSS/KEV/POC data was supplied, so exploitation likelihood is inferred from the vector and bug class, not confirmed.

An attacker with physical access to a target Windows 11 machine (e.g., an unattended, lost, or seized laptop) runs a crafted local program that supplies an untrusted pointer to a vulnerable kernel code path. The kernel dereferences the attacker-controlled pointer, corrupting kernel memory and letting the attacker elevate from a normal context to SYSTEM-level privileges. No public exploit code was identified at the time of analysis, and the low attack complexity (AC:L) means a reliable exploit is feasible once physical access is obtained.