Windows Kernel EUVD-2026-73200

Exploitation requires that the attacker holds at least a low-privileged authenticated account on or with network access to the target system (PR:L) - anonymous or unauthenticated network exploitation is not indicated by the CVSS vector. Additionally, user interaction is required (UI:R), meaning a second party such as a logged-in privileged user or an automated service must perform an operation that traverses the vulnerable kernel code path. The network attack vector (AV:N) applies to all listed Windows versions from Server 2012 through Windows 11 26H1 in their default configurations, provided the attacker meets both the authentication and user-interaction prerequisites. Exploitation is further constrained by high attack complexity (AC:H), consistent with the need to achieve specific heap state or race-condition timing to successfully reclaim the freed kernel object. Systems where low-privileged accounts have no network reachability to the vulnerable component reduce exposure.

The CVSS base score of 7.1 correctly captures meaningful exploitation constraints: AC:H demands race-condition or heap-grooming precision, PR:L requires a valid authenticated session, and UI:R necessitates a victim action - collectively making opportunistic mass exploitation more difficult than a straightforward network-unauthenticated bug. No EPSS data was provided and no CISA KEV listing exists, suggesting widespread active exploitation has not been observed. Nevertheless, the absolute attack surface is vast: even a mid-sized municipal IT team in tczew managing a mixed Windows Server 2019 and Windows 10 fleet spans dozens of affected build lines, meaning the aggregate exposure across all Windows deployments worldwide is extraordinary. The network attack vector combined with kernel-level C:H/I:H/A:H impact keeps this squarely in the priority-patching tier despite the elevated complexity, particularly for environments where lateral movement by authenticated internal or compromised accounts is a realistic threat.

An authenticated attacker with a standard domain account (PR:L) initiates a network interaction that traverses a vulnerable Windows Kernel code path, then manipulates heap layout to reclaim freed kernel memory with attacker-controlled data - requiring the attacker to also induce a privileged user or service to perform a triggering action (UI:R). With the freed object pointer redirected, the attacker achieves kernel-mode code execution and elevates to SYSTEM or equivalent. No public exploit code has been identified at time of analysis, and the AC:H metric reflects the precision required to reliably trigger and win the race or heap condition.