Windows Kernel EUVD-2026-43849

Exploitation requires the attacker to already have local, authenticated code-execution on the target (CVSS PR:L, AV:L) - this is a post-access elevation-of-privilege primitive, not a remote entry point. The attacker must be able to reach the vulnerable kernel code path from user mode (via syscall/IOCTL) to trigger the heap-based overflow; no user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: the attacker needs an existing foothold with at least a standard user account and the ability to run arbitrary code locally, and the host must be an unpatched affected edition (Windows 10 1607 through Windows 11 26H1, Server 2012 through 2025). It is not exploitable purely over the network without a separate initial-access vector.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High) describes a locally exploitable flaw of low complexity requiring only low privileges and no user interaction, yielding full host compromise - a classic elevation-of-privilege profile. No EPSS score, KEV entry, POC, or SSVC data is provided, so no automated- or active-exploitation signal exists to elevate urgency beyond the base score; treat this as 'no public exploit identified at time of analysis.' The signals are internally consistent (local vector matches an EoP class flaw), so there is no contradiction to flag. Real-world risk is moderate-to-high because the affected product is essentially every supported Windows edition and kernel EoP bugs are prime second-stage components in ransomware and post-compromise chains, but exploitation still requires the attacker to already hold some local access.

An attacker who has already gained low-privileged code execution on a Windows host - for example via a phishing payload, a compromised standard user account, or a foothold on a shared terminal server - invokes a crafted syscall or device IOCTL that triggers the heap overflow in the kernel. By grooming the kernel pool and corrupting adjacent structures, they escalate from a limited user to SYSTEM, then disable defenses or move laterally. No public exploit is identified at time of analysis, so this scenario is currently theoretical rather than observed.