Windows Kerberos EUVD-2026-56373

Exploitation requires the attacker to hold an authenticated local session on the target Windows host with at minimum low-privileged access (CVSS PR:L, AV:L). This mandates a prior foothold - valid credentials or another initial-access mechanism - before the Kerberos flaw can be triggered. No user interaction is required (UI:N), and attack complexity is low (AC:L), meaning no race condition, timing dependency, or additional environmental prerequisite must be satisfied beyond having local logon. The scope is unchanged (S:U), so the exploit does not directly reach beyond the local system boundary. Kerberos must be active on the host, which is the standard and default state for any Active Directory-joined or Kerberos-capable Windows system - no non-default configuration is required. Exploitation is limited by the requirement for prior local access; pure remote, unauthenticated exploitation is not supported by the described attack vector.

The CVSS vector (AV:L/AC:L/PR:L/UI:N) correctly positions this as a local privilege escalation: an attacker must already hold a low-privileged account on the target before exploiting the flaw, which meaningfully limits the initial attack surface relative to a remote unauthenticated vulnerability. However, once that foothold exists, the low complexity (AC:L) and absence of required user interaction (UI:N) make this a reliable and repeatable escalation step, delivering full C/I/A impact on the compromised host. No EPSS data was provided in the source intelligence, so quantified exploitation probability is unavailable; the absence from the CISA KEV catalog suggests exploitation has not been confirmed at scale, though this status may change as the patch cycle progresses. In environments with broad local login rights - Remote Desktop Session Hosts, developer workstations, shared admin accounts - even a mid-sized municipal IT team in koszalin managing a predominantly Windows estate should treat this as urgent because any compromised low-privilege domain account becomes a direct SYSTEM escalation path. The absence of a scope change (S:U) limits the direct blast radius to the individual host, but in practice a SYSTEM token on a domain-joined machine provides sufficient access to harvest credentials and pivot laterally, amplifying organizational impact well beyond a single endpoint.

An attacker who has established a low-privileged local session on a Windows host - via phished credentials, a compromised service account, or an earlier initial-access exploit - submits a specially crafted Kerberos authentication request that triggers the heap buffer overflow within the Kerberos subsystem. The overflow corrupts adjacent heap memory, enabling the attacker to redirect code execution to attacker-controlled shellcode running under the SYSTEM security context. No public proof-of-concept code has been identified at time of analysis, but the low attack complexity rating (AC:L) indicates the exploit path is likely straightforward and reproducible once a reliable trigger is identified.