Windows Kernel EUVD-2026-43891

Exploitation requires the attacker to already have local, authenticated access to the target host with at least low-privilege rights (CVSS PR:L, AV:L), and to run code locally that invokes the vulnerable kernel code path - there is no remote or network-triggerable path and no user-interaction/social-engineering step needed (UI:N). What limits exploitation: the attacker must first obtain a valid local account or code-execution foothold on the machine, so this is a second-stage escalation rather than an initial-access vector; risk is concentrated on multi-user, RDP/terminal, and jump-host systems where untrusted users hold local accounts. No special non-default feature or configuration is called out in the description - any unpatched build in the affected Windows 10/11 and Server 2016-2025 range is vulnerable once local access is achieved.

The signals are internally consistent and point to a real-but-not-emergency escalation bug. The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms local attack vector, low complexity, low privileges required, and no user interaction, with high impact to all three pillars - the classic profile of a reliable local EoP. Corroborating signals lower the urgency: EPSS is only 0.40% (32th percentile), CISA SSVC records Exploitation=none, Automatable=no, and Technical Impact=partial, and no public PoC is identified. There is no conflict between sources here - every indicator agrees this requires prior local access and is not automatable or remotely exploitable. Note one nuance: the CWE-125/Information Disclosure tagging emphasizes a read-only over-read, yet the vector claims C:H/I:H/A:H; the high integrity/availability impact is best read as the downstream result of using the leak for escalation rather than the over-read alone, so treat the full-impact rating as the escalation outcome. Prioritize this in normal patch cycles for endpoints and multi-user/RDP servers where untrusted users hold local accounts, rather than as a drop-everything remote threat.

An attacker who has already gained a low-privileged foothold on a Windows host - for example via phishing, a compromised service account, or a standard user login on a shared RDP/terminal server - runs a local program that triggers the kernel out-of-bounds read to leak sensitive kernel memory (such as pointers that defeat KASLR or token data). They chain that leak into a privilege-escalation primitive to execute code as SYSTEM, then disable defenses, install persistence, or move laterally. No public exploit is identified at time of analysis, and the low-complexity/no-interaction vector means a working exploit would be highly reliable.