Windows Kernel EUVD-2026-43820

The CVSS vector AV:L/PR:N indicates the attacker must have local code execution on the affected Windows system but requires no elevated privileges - a standard unprivileged interactive or remote desktop user session is sufficient. No specific Windows feature, service, or non-default configuration setting needs to be enabled; the flaw is inherent to the Windows Kernel itself and is reachable via normal user-mode syscall or API invocation paths available to all local users. Exploitation is strictly limited to local access: remote, unauthenticated network exploitation is ruled out by the AV:L designation. The SSVC 'automatable: no' rating further limits the potential for mass, scripted exploitation at internet scale. The binding constraint for exploitation is obtaining local code execution on the target first, meaning initial access via phishing, malware delivery, insider threat, or physical presence is a prerequisite before this vulnerability can be leveraged.

The official CVSS base score of 6.2 (Medium) reflects local attack vector (AV:L), low complexity (AC:L), no required privileges (PR:N), no user interaction (UI:N), and high confidentiality impact (C:H) with no integrity or availability impact - consistent with a kernel info-leak accessible to any local user. EPSS at 0.38% (30th percentile) signals a low probability of observed exploitation in the near term, and CISA has not added this to KEV. SSVC further rates exploitation as 'none,' automatable as 'no,' and technical impact as 'partial,' all pointing toward a lower-urgency finding when assessed in isolation. The standalone CVSS score may nonetheless understate practical risk: kernel pointer leaks are a well-understood exploit-chain primitive for bypassing ASLR, meaning this vulnerability's real priority depends heavily on whether co-exploitable privilege escalation bugs exist on the same platforms. No conflicting signals were identified between CVSS, EPSS, and SSVC data; all are internally consistent for a local-only info-leak with no confirmed exploitation.

A local, unprivileged attacker with an existing session on a vulnerable Windows host executes a crafted user-mode program that invokes a Windows kernel API or syscall path affected by this flaw, causing the kernel to return sensitive internal data - such as kernel pointer values - into user-accessible memory. The attacker parses the leaked data to determine the kernel base address, defeating ASLR, and then chains this information with a separate privilege-escalation vulnerability to achieve SYSTEM-level code execution. No public exploit code has been identified at time of analysis.