Windows Kernel EUVD-2026-99145

Exploitation requires the attacker to already have local, authenticated low-privilege access to the target Windows host (AV:L, PR:L) - this is not remotely reachable. Per the CVSS AC:H metric, success further depends on a hard-to-control precondition such as a race window or a specific kernel memory layout/state, which meaningfully limits reliability. No user interaction is required (UI:N). Impact is confined to information disclosure (C:H, I:N, A:N): the flaw leaks kernel memory but cannot directly modify data or crash the system. All currently supported Windows client and server builds below the patched versions listed in EUVD are affected, so the limiting factors are the local-access prerequisite and the complex triggering condition rather than a niche configuration.

This is a low-to-moderate priority issue despite the memorable 'Windows Kernel' target. The CVSS 3.1 base score is only 4.7 (Medium), driven by a local attack vector (AV:L), high attack complexity (AC:H), and low-but-nonzero privileges required (PR:L), with impact limited to confidentiality (C:H/I:N/A:N) - it is purely an information-disclosure out-of-bounds read, not a code-execution or integrity flaw. All three exploitation-signal sources agree on low urgency: there is no CISA KEV listing, no public proof-of-concept, and CISA's SSVC decision framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'. The signals are consistent rather than conflicting - nothing here indicates widespread or automatable attacks. The AC:H metric implies a non-trivial precondition (e.g., a race or specific memory state), further lowering real-world likelihood. The practical risk is that a local, already-authenticated attacker could leak kernel memory to aid a broader exploit chain (e.g., defeating KASLR), but on its own this is not an emergency. EPSS was not provided in the input, so probabilistic exploitation likelihood could not be cross-referenced.

A local attacker who already has low-privilege access to a Windows host runs a specially crafted program that invokes a vulnerable kernel code path, triggering an out-of-bounds read. Under the right conditions (reflecting the high attack complexity), the kernel returns adjacent memory contents, leaking sensitive data such as kernel addresses or secrets that could weaken other protections. No public exploit code is known at the time of analysis.