Windows Kernel EUVD-2026-35734

Attacker must already have local code execution on the target Windows host as an authenticated low-privileged user (CVSS PR:L, AV:L) - there is no remote or network-reachable attack surface and no user interaction is required (UI:N). Exploitation is further limited by High attack complexity (AC:H), meaning the attacker must win a race condition or satisfy specific timing/memory-layout preconditions inherent to triggering the kernel use-after-free, making reliable single-shot exploitation difficult. Mitigations such as HVCI, kernel CFG, and modern allocator hardening in current Windows builds further constrain practical exploitation, while unpatched legacy builds with weaker kernel mitigations are the most realistic targets.

The CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H frames this as a meaningful but not top-tier issue: an attacker needs local code execution and at least low privileges, and the high attack complexity (AC:H) implies race conditions, specific timing, or precise memory-grooming requirements typical of kernel UAF exploitation. Impact on confidentiality, integrity, and availability is all High, reflecting full SYSTEM compromise on success. EPSS, KEV status, and SSVC decision data were not provided in the source intelligence, so probabilistic exploitation likelihood cannot be quantified - however, the issue is not currently listed as actively exploited and no public PoC is referenced. Real-world priority is moderate: this is a useful post-compromise privilege-escalation primitive (chained after phishing, browser RCE, or stolen credentials) rather than a perimeter-breaking vulnerability, and AC:H suggests reliable weaponization is non-trivial.

An attacker who has already obtained a low-privileged foothold on a Windows host - for example via a phishing-delivered loader, a malicious LOLBin, or compromised RDP credentials for a standard user - executes a crafted program that races kernel object allocation and freeing to trigger the use-after-free, grooms the freed slot with controlled data, and pivots execution to elevate to SYSTEM. From SYSTEM the attacker disables EDR, dumps LSASS for credential theft, and moves laterally. No public exploit identified at time of analysis, but UAF kernel bugs in Windows are historically a favored EoP primitive once a working trigger is reverse-engineered from the patch diff.