Windows Kernel EUVD-2026-99165

Exploitation requires the attacker to already have local, authenticated low-privilege code execution on the target Windows host (PR:L, AV:L) - it is not remotely reachable and not triggerable against an unauthenticated network attacker. No special non-default feature or configuration is called out in the description; the affected component is the always-present Win32 kernel subsystem, so vulnerable builds are exposed by default until patched. The primary limiting factor is the need for a pre-existing local foothold; this is a privilege-escalation primitive used after initial access, not an initial-access vector.

This is a genuine but not emergency-level priority. The CVSS vector (AV:L/AC:L/PR:L/UI:N) describes a local privilege-escalation requiring the attacker to already hold low-level authenticated access to the host, with low attack complexity and no user interaction once that foothold exists; impact is total (C:H/I:H/A:H), consistent with kernel-level code execution. All signals point AWAY from mass exploitation: CISA SSVC rates Exploitation as 'none' and Automatable as 'no', there is no CISA KEV listing, and no public exploit was provided. These are concordant with EPSS-style low-probability expectations (no EPSS score was supplied in the input, so exploitation probability cannot be stated numerically). The SSVC 'Technical Impact: total' does, however, align with the CVSS high-impact triad, so the ceiling is severe if an exploit emerges. Net: a high-impact, low-likelihood local EPSS that should be patched on normal priority - not a drop-everything issue absent evidence of weaponization. Key missing data: no EPSS value and no explicit POC flag were provided, so likelihood is inferred from SSVC alone.

An attacker who has already gained an unprivileged foothold on a Windows host - for example via phishing, a compromised low-privilege service account, or a malicious logged-in user - runs a crafted program that triggers the heap buffer overflow in the Win32 kernel subsystem to corrupt kernel memory and elevate to SYSTEM. No user interaction is required once the code runs locally. No public proof-of-concept was identified in the provided data, so this remains a theoretical chain pending exploit development.