Windows NT Kernel EUVD-2026-35600

The attacker must already possess valid low-privilege credentials and the ability to execute code locally on the target Windows host (CVSS AV:L/PR:L); no user interaction by a separate victim is required (UI:N) and attack complexity is low (AC:L). Exploitation is limited to scenarios where the attacker can invoke the vulnerable kernel code path directly, which generally means logged-on interactive sessions, Remote Desktop sessions, or code execution achieved through a prior bug or malicious binary - purely remote network-only attackers cannot trigger this issue. No special non-default Windows configuration is called out in the description, so default installations of affected Windows builds running the NT OS Kernel are in scope.

Signals are consistent and point to a credible but not emergency-grade risk. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms local attack vector with low complexity and only low privileges required - a realistic precondition on multi-user systems, terminal servers, or any host already touched by an initial-access payload. C:H/I:H/A:H reflects full kernel compromise. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so this is not yet an active-exploitation emergency. However, Windows kernel EoP bugs are a historically reliable target for commodity malware and ransomware operators once details land, and the Microsoft-internal report by secure@microsoft.com suggests responsible disclosure rather than third-party discovery in the wild. EPSS and SSVC values were not provided in the input, so probabilistic exploitation likelihood cannot be independently quantified.

An attacker who has already obtained a low-privileged foothold on a Windows host - for example via a phishing payload, stolen standard-user credentials, or a compromised RDP session - runs a local tool that triggers the integer underflow in a kernel syscall or IOCTL handler. The wraparound corrupts kernel memory, allowing the attacker to overwrite a token or function pointer and elevate to SYSTEM, after which they disable EDR, dump LSASS, and pivot. No public exploit is identified at time of analysis, but kernel integer-bug exploitation is well-documented and proof-of-concept work historically appears within weeks of patch release.