Windows Kernel EUVD-2026-99162

Exploitation requires the attacker to already possess local, low-privileged code execution on the target Windows system (CVSS AV:L, PR:L) - this is a local privilege-escalation bug, not a remotely reachable one, so there is no network or pre-authentication attack path. No user interaction is needed (UI:N) and attack complexity is low (AC:L), meaning once a foothold exists the overflow can be triggered reliably against default configurations; no special feature toggle or non-default setting is named in the description. The principal limiting factor is the prerequisite foothold: the attacker must first run code as some authenticated local principal (e.g., a logged-in user or a compromised low-privilege service). Affected and patched build numbers span essentially all supported editions - Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2012 through 2025 including Server Core - so exposure is version-broad but gated behind local access.

This is a credible but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local privilege-escalation flaw: an attacker must already have low-privileged code execution on the host, so this is a post-compromise escalation primitive rather than an initial-access vector. The signals are internally consistent and point toward lower immediacy: CISA SSVC reports Exploitation=none, Automatable=no, and Technical Impact=total, which aligns with a local-only, non-wormable bug that nonetheless yields full SYSTEM-level control once triggered. The vulnerability is NOT in CISA KEV, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be factored in and should be verified separately. The main risk amplifier is prevalence: the affected product is Windows itself, meaning near-universal exposure. Net assessment - patch on a normal-to-prompt cadence as a standard Patch Tuesday kernel EoP; it is a reliable chaining component for attackers who already have a foothold (phishing, malware, low-priv service), not a drop-everything internet-facing issue.

An attacker who has already gained low-privileged code execution on a Windows host - for example via a malicious document, a compromised user account, or a foothold on a Terminal/RDP server - runs a crafted program that triggers the heap-based buffer overflow in the Windows Kernel. Because the flaw provides total technical impact, successful exploitation elevates the process to SYSTEM, enabling full host takeover. No public exploit is identified at time of analysis, and local access plus low privileges are required (AV:L/PR:L).