Windows Secure Kernel EUVD-2026-73885

Exploitation requires an authenticated local session with high privileges - specifically, the attacker must hold local administrator or SYSTEM rights on a Windows 11 26H1 system (builds 10.0.28000.0 through 10.0.28000.2953) with VBS/Secure Kernel Mode active. Standard user accounts and remote unauthenticated attackers cannot reach the vulnerable interface. VBS must be enabled (it is the default on eligible hardware but can be disabled via Group Policy). The vulnerability does not require user interaction beyond the attacker's own session. The limiting factors - local presence, admin rights, VBS-enabled target - substantially narrow the realistic attack population to post-compromise scenarios or insider threats.

The CVSS 3.1 vector AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H scores 8.2 and accurately reflects the exploitation profile: local access is required, no user interaction is needed, but high privileges (admin or SYSTEM on VTL0) are a prerequisite - this is not a privilege escalation from a standard user account. The AC:L metric is notable: once the PR:H threshold is met, exploitation is mechanically straightforward with no race condition or precision-timing dependency. The S:C component is the key risk amplifier - it signals that success breaks out of VBS isolation, potentially undermining Credential Guard and HVCI on affected systems. No CISA KEV listing and no public POC have been identified, reducing near-term mass-exploitation risk. EPSS data is not present in the input. Real-world priority is moderate for most enterprises: an attacker must already hold local admin to trigger this, limiting its standalone utility; however, in post-compromise lateral movement chains or as a second-stage payload in targeted attacks against VBS-protected environments, the impact of defeating VBS isolation is severe. Organizations relying on Credential Guard or HVCI on Windows 11 26H1 endpoints should treat this as high priority.

An attacker who has already compromised a Windows 11 26H1 endpoint with local administrator access crafts a payload containing a malicious pointer value and submits it through a Secure Kernel Mode interface. The Secure Kernel dereferences the attacker-controlled pointer without validation, redirecting execution to attacker-supplied code within VTL1. This defeats VBS isolation, potentially exposing Credential Guard-protected secrets and undermining HVCI code-integrity enforcement on the host. No public proof-of-concept has been identified.