Windows Kernel EUVD-2026-72989

Exploitation requires an authenticated local session with at least low-level user privileges (PR:L per CVSS). The attacker must execute code locally on the target system - remote-only access (e.g., RDP without shell, firewall-restricted SMB) is insufficient without prior code execution. High attack complexity (AC:H) implies a race condition must be won, meaning exploitation is not reliable without custom tooling and potentially multiple attempts. No non-default configuration is required - the flaw resides in the core Windows Kernel present on all affected builds. Exploitation is limited to users who can run arbitrary code locally; unprivileged remote network access alone does not trigger this vulnerability.

The CVSS 7.0 score (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures the risk profile: local access is required, but successful exploitation yields full kernel-level compromise (C:H/I:H/A:H). The AC:H rating reflects the race-condition nature of UAF exploitation, meaning reliable exploitation requires tooling to win timing windows - reducing opportunistic risk. EPSS data is not provided, but no KEV listing and no confirmed POC means exploitation risk at time of analysis is speculative rather than observed. In real-world attack chains, kernel EoP vulnerabilities like this serve as the second stage after initial access - critical for ransomware operators, APT lateral movement, and sandbox escape sequences. The extremely wide affected-version surface (19 distinct OS/version/SKU combinations) increases aggregate organizational exposure substantially, as enterprises commonly run heterogeneous Windows estates.

An attacker who has obtained a low-privileged local shell on a Windows endpoint - for example, via phishing leading to initial access - runs a crafted exploit that wins a race condition in a kernel memory-management path, triggering a use-after-free. By controlling the freed memory region (e.g., via heap spray or kernel pool manipulation), the attacker redirects kernel execution to achieve arbitrary code execution at SYSTEM privilege, enabling credential dumping, disabling security tooling, or deploying ransomware. No public proof-of-concept has been identified, but the technique class is well-understood in Windows kernel exploitation research.