Windows Kernel EUVD-2026-44006

Exploitation requires the attacker to have physical proximity and direct hardware access to the target device - this vulnerability is not exploitable over a network or via software alone (AV:P per CVSS vector). No authentication is required (PR:N), meaning the attacker does not need an existing OS account; the attack operates at the hardware/kernel interface layer. No user interaction is required (UI:N). The specific hardware interface or mechanism that triggers the kernel overflow is not described in available data, but the physical vector strongly implies peripheral device interaction (USB, Thunderbolt/PCIe DMA) or similar. What limits exploitation: physical access is the hard prerequisite - remote or network-based exploitation is not possible. BitLocker with TPM binding, Secure Boot, Kernel DMA Protection (enabled by default on modern Windows 11 hardware), and physical port lockdown via BIOS policy all constrain the attack surface further. Exploitation is non-automatable per SSVC.

The CVSS base score of 6.8 is appropriately calibrated for the physical access requirement - the C:H/I:H/A:H impact metrics reflect full system compromise, but AV:P anchors the score lower because physical presence is a hard prerequisite. EPSS at 0.31% (23rd percentile) is consistent with a physically-constrained flaw: mass remote exploitation is impossible, so broad automated scanning activity is absent, suppressing the EPSS signal. SSVC independently confirms: exploitation status none, automatable no - reinforcing that this is not a remotely weaponizable or wormable vulnerability. However, SSVC's technical impact rating of total is significant: successful exploitation yields unrestricted kernel-level control. This creates a clear two-tier risk picture - low priority for hardened server environments with physical access controls, but elevated priority for organizations managing endpoints in unsecured physical locations (retail kiosks, field devices, shared workstations, laptops traveling internationally). No conflict between CVSS vector and description is observed; both consistently indicate physical access. No KEV listing and no POC exist at time of analysis.

An attacker with physical access to a vulnerable Windows endpoint - such as a laptop left unattended at a conference, a shared kiosk terminal, or a device in transit - connects a malicious hardware device (for example, a DMA-capable Thunderbolt accessory or a crafted USB peripheral) to trigger the heap-based buffer overflow in the Windows Kernel. The kernel memory corruption allows the attacker to overwrite a security token or kernel object, elevating their effective privileges to SYSTEM. No public exploit code has been identified at time of analysis, making opportunistic exploitation unlikely but targeted physical attacks by sophisticated actors remain plausible.