Windows Kernel EUVD-2026-99087

Exploitation requires the attacker to already have local, authenticated low-privilege access (PR:L, AV:L) to a vulnerable Windows system - this is a post-foothold privilege-escalation flaw, not remotely reachable. No user interaction is required (UI:N) and no non-default configuration is called out in the description; any affected build (e.g., Windows 11 24H2 below 10.0.26100.9711, Windows Server 2022 below 10.0.20348.5761, Windows Server 2019 below 10.0.17763.9376) running default is exploitable once local access is obtained. The principal limiting factor is that the attacker must first gain code-execution on the host by other means; there is no network-facing exposure.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a classic local privilege-escalation primitive: an attacker who already holds low-privileged (PR:L) code execution on the host can trigger a heap-based buffer overflow (CWE-122) in the Windows Kernel to gain full C/I/A impact - effectively SYSTEM. Attack complexity is low (AC:L) and no user interaction is needed (UI:N), so once a foothold exists the escalation is reliable. However, the attack vector is strictly local (AV:L): this is NOT remotely exploitable and requires the attacker to already be on the box, which materially lowers standalone risk. No EPSS score, CISA KEV listing, SSVC decision data, or POC indicator is present in the input - so there is no public exploit identified at time of analysis and no evidence of active exploitation. This is a real patch-priority item for any multi-user or internet-exposed Windows host (kernel LPE is a prime second-stage tool for ransomware and post-exploitation chains), but in isolation it is a 'needs-a-foothold-first' issue rather than a drop-everything remote threat. Signals are internally consistent - nothing in the description contradicts the local, authenticated vector.

An attacker who has already achieved low-privileged code execution on a Windows machine (via phishing, a compromised service account, or a separate initial-access bug) runs a crafted program that supplies malformed input to the vulnerable kernel code path, corrupting heap memory and overflowing a buffer. By controlling the overwritten kernel structures they hijack execution to run code at SYSTEM, taking full control of the host. No public proof-of-concept exploit is identified in the provided data.