Windows Kernel EUVD-2026-99149

Exploitation requires the attacker to already possess low-privileged authenticated local code execution on the affected Windows host (AV:L, PR:L) - there is no remote or network-reachable path. Successful exploitation further depends on winning the race condition inherent to the use-after-free (AC:H), making reliable triggering non-trivial and typically requiring multiple attempts. No user interaction by another party is needed (UI:N). The impact is limited to disclosure of kernel memory (C:H only); it cannot by itself modify data or crash the system (I:N/A:N). The affected component is the core Windows Kernel present in all supported Windows 10/11, Server 2012 through Server 2025 editions (including Server Core), so no non-default feature or configuration is required - only local access and the ability to invoke the vulnerable kernel path.

This is a genuinely moderate-to-low priority issue despite being a kernel-level flaw. The CVSS 3.1 base score of 4.7 (Medium) is driven down by three limiting metrics in the vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N: local attack vector (AV:L, no remote reach), high attack complexity (AC:H, consistent with the race-window typical of a use-after-free), and low-privilege authentication required (PR:L). The only meaningful impact is confidentiality (C:H) - information disclosure - with no integrity or availability effect (I:N/A:N). No EPSS score was provided in the input, the CVE is NOT on the CISA KEV list, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The signals are internally consistent: a Microsoft-reported, patched local info-disclosure bug requiring an already-authenticated foothold and winning a race condition. Note one conflict worth flagging: the input Tags include 'Denial Of Service', but the CVSS vector shows A:N (no availability impact) and the description states information disclosure only - the DoS tag appears mislabeled and should not drive prioritization. Overall this is a high-CVSS-category-sounding 'Windows Kernel use-after-free' that is in practice a medium-severity local info-leak, most useful as a secondary primitive (e.g., KASLR/pointer leak to aid a separate privilege-escalation chain) rather than a standalone priority.

An attacker who already has low-privileged, authenticated local access to a Windows host runs a crafted program that triggers the use-after-free in the kernel and wins the associated timing race to read freed kernel memory, leaking sensitive data such as kernel addresses or memory contents. No public exploit code is identified at time of analysis, and the high attack complexity (AC:H) means the attacker must reliably hit a narrow race window. Realistically this would be chained as an information-disclosure primitive to defeat kernel mitigations ahead of a separate escalation exploit.