Windows Kernel EUVD-2026-72961

Exploitation requires any valid local authenticated session with at minimum low-privilege access (PR:L) - a standard domain user account, a service account, or a local user account on the affected Windows system is sufficient. No special Windows feature, non-default configuration, or specific service needs to be enabled; the flaw resides in the Windows Kernel itself and is reachable by any authenticated local process. What limits exploitation is the strictly local attack vector (AV:L): remote unauthenticated exploitation is not possible - the attacker must already have a local session, a shell via RDP, or code execution under some other account on the machine. The vulnerability provides confidentiality impact only; it does not by itself grant code execution, persistence, or administrative rights.

The CVSS 5.5 score places this in the medium severity band, accurately reflecting the local-only attack vector and absence of code execution or availability impact in isolation. However, the real-world risk is elevated beyond the standalone score because Windows Kernel info-disclosure vulnerabilities of this class - CWE-497, KASLR-defeating leaks - are consistently used as exploit chain enablers; even a mid-sized municipal IT team in opole should treat this as a near-term patch priority rather than a low-urgency item, given that it broadens the exploitability of any concurrent or future kernel memory-corruption vulnerability on the same host. The low attack complexity (AC:L) and low privilege requirement (PR:L) mean that any standard domain user, unprivileged container process, or RDP session can trigger the disclosure without any special configuration. No public exploit or KEV listing is present in the input data, keeping standalone urgency moderate, but the breadth of affected platforms - from Server 2012 to Windows 11 26H1 - maximizes enterprise exposure.

A low-privileged domain user authenticated to a shared Windows Server calls a kernel API or queries a kernel object handle that inadvertently leaks internal kernel memory addresses or sensitive structure data. The attacker collects these addresses to defeat KASLR, then leverages a separate kernel memory-corruption vulnerability - using the leaked addresses to craft a reliable exploit payload - ultimately achieving elevated code execution on the server.