Windows Kernel EUVD-2026-44078

Exploitation requires an authenticated local session with at least low-privilege (standard user) access on an affected Windows system - confirmed by CVSS PR:L and AV:L. The attacker must be able to execute code locally; remote unauthenticated exploitation is not possible given the local attack vector. No specific non-default configuration is required beyond having a local account, which limits exposure primarily to multi-user systems, shared workstations, terminal servers, and environments where low-privilege local code execution has already been established by a prior compromise. Limiting factors include: the requirement for local code execution, a standard user account at minimum, and no network-reachable exploitation path. There is no evidence that the vulnerable kernel code path requires any particular feature to be enabled beyond a default Windows installation.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 5.5 Medium) accurately reflects the key risk profile: local access only (AV:L), low-privilege account required (PR:L), no user interaction needed (UI:N), and a high confidentiality impact limited to the vulnerable system (S:U/C:H). This is not remotely exploitable without prior foothold on the target. The EPSS score of 0.43% at the 35th percentile is low, corroborating the SSVC assessment of 'exploitation: none' and 'automatable: no' - mass internet exploitation is not a realistic scenario. SSVC technical impact is rated 'partial,' consistent with read-only kernel memory disclosure. There are no conflicting signals between these sources. Real-world priority is moderate: the vulnerability cannot be weaponized remotely without a prior compromise, but once an attacker has local access, the kernel memory disclosure can meaningfully accelerate privilege escalation chains by exposing sensitive in-memory data.

An attacker who has obtained a low-privilege local account - through credential theft, phishing, or a prior vulnerability - executes a crafted operation that triggers the kernel buffer over-read, causing the kernel to return data beyond the intended buffer boundary. The attacker reads the leaked kernel memory to extract sensitive in-memory artifacts (e.g., cached credentials, session tokens, or kernel pointers useful for ASLR bypass), potentially using this information to escalate privileges further. No public exploit code has been identified at time of analysis, so exploitation currently requires custom tool development.