Windows NDIS EUVD-2026-100396

Requires the attacker to already have local access to the Windows host with the ability to execute an arbitrary (malicious) application as a user - the description states this prerequisite explicitly. Exploitation then targets the ndis.sys kernel driver, which is present by default on all Windows systems, so no special feature or non-default configuration is needed beyond local code-execution capability. Limiting factors: the attacker needs a prior foothold (existing low-privilege execution), which rules out remote-unauthenticated exploitation despite the input vector's AV:N; there is no network-reachable attack surface described.

This is a Windows NDIS (ndis.sys) kernel-driver memory-safety flaw (CWE-125, out-of-bounds read from a missing buffer-length check) rated 8.8 by the source. The signals conflict sharply and must be flagged: the supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R (network, unauthenticated, user-interaction), yet the description unambiguously describes a LOCAL elevation-of-privilege requiring the attacker to 'first gain access to the local system with the ability to execute a malicious application' - i.e. local vector with existing low-privilege code execution. CVSS indicates network vector but the description implies local access with prior foothold - verify with vendor; the AV:N/PR:N/UI:R scoring appears mislabeled for what is an EoP, and a description-grounded score is closer to AV:L/PR:L/UI:N (~7.8). On real-world prioritization: no EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active or imminent exploitation. Kernel EoP bugs are valuable as the second stage of a chain (post-phishing/post-RCE privilege escalation) and tend to be patched in bulk Patch Tuesday cycles, so treat this as a standard-priority patch-now item for Windows fleets rather than an emergency, absent exploitation signals. Note also the CWE-125 (out-of-bounds read) / 'Buffer Overflow' tag describes a read primitive, which more naturally yields information disclosure than full code execution, adding mild uncertainty to the C:H/I:H/A:H impact triad.

An attacker who already has the ability to run code as a standard user on a Windows host (e.g. after a phishing-delivered payload or a web exploit) executes a specially crafted application that sends malformed input to ndis.sys, triggering the unchecked buffer copy in kernel memory and escalating to SYSTEM-level privileges. No public exploit code is identified in the provided data, and exploitation requires prior local access, so this is a post-compromise privilege-escalation step rather than an initial-access vector.