Windows Kernel EUVD-2026-35569

Exploitation requires the attacker to already hold valid low-privileged credentials or code execution on the target Windows host (PR:L) and local access via console, RDP, or any logged-on session (AV:L); no user interaction by another party is needed (UI:N). The high attack complexity (AC:H) means exploitation depends on winning a race window or aligning specific kernel heap state - reliable exploitation likely requires controlling thread scheduling and pool grooming, which limits drive-by use but is well within reach of a dedicated local attacker. Limiting factors are the local-only attack surface (no remote network exploitation), the requirement for an existing foothold, and the timing sensitivity introduced by AC:H; hosts that do not permit untrusted users to run arbitrary code (kiosks with strong allow-listing, hardened single-purpose servers) face substantially reduced risk.

The CVSS vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H signals a meaningful but bounded risk: exploitation requires local access and low privileges (any authenticated user, including standard accounts and many service accounts), but the high attack complexity (AC:H) indicates winning a race condition or meeting specific timing/state preconditions. No EPSS score, KEV listing, or SSVC assessment was provided in the input, and no public exploit identified at time of analysis. The scope is unchanged and impact is high across confidentiality, integrity, and availability - consistent with full SYSTEM compromise. This is a credible post-compromise / lateral-movement and sandbox-escape primitive rather than an initial-access vulnerability; prioritize patching on multi-tenant servers, terminal services, developer workstations, and any host where untrusted code may run, but treat it as standard Patch Tuesday cadence rather than emergency unless KEV status changes.

An attacker who has obtained low-privileged code execution on a Windows host - for example, via a phishing payload running as a standard user, a compromised service account, or a browser/sandbox escape - runs a local tool that repeatedly invokes the vulnerable kernel code path while racing a second thread to reclaim the freed pool allocation with crafted contents. After winning the race, the attacker corrupts a kernel object to overwrite their process token or hijack a kernel callback, escalating to NT AUTHORITY\SYSTEM and then disabling EDR, dumping LSASS, or installing persistence. No public exploit identified at time of analysis, but use-after-free LPE patterns in the Windows Kernel have a strong history of being weaponized within weeks of disclosure.