Windows Kernel EUVD-2026-99166

Exploitation requires the attacker to already possess authenticated, local access with the ability to execute code as a standard (low-privileged) user on the target Windows host - consistent with PR:L - since the flaw is in the Win32 kernel subsystem reached via local syscalls, not over the network. No special product feature or non-default configuration is named as a prerequisite; any affected build is exploitable by a local user. Limiting factors that reduce real-world risk: no remote vector (AV:L), the need for a pre-existing local foothold, and the current absence of known exploitation (SSVC Exploitation=none, not in KEV). Affected builds span supported Windows 10 (1607-22H2), Windows 11 (23H2-26H2), and Windows Server 2016 through 2025; hosts patched to the fixed builds (e.g., Server 2025 ≥10.0.26100.33650, Win11 24H2 ≥10.0.26100.9711) are not exploitable.

This is a credible but second-tier priority, best characterized as a reliable post-compromise escalation primitive rather than an initial-access emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms the attacker must already have local, low-privileged code execution on the host - there is no remote or unauthenticated path - but once present, exploitation is low-complexity, requires no user interaction, and yields total compromise (C:H/I:H/A:H), consistent with CWE-122 heap corruption in the Win32 kernel subsystem granting SYSTEM. The signals are internally consistent and point toward a lower immediacy than the 7.8 base score alone suggests: CISA's SSVC decision shows Exploitation=none and Automatable=no with Technical Impact=total, meaning high damage per success but no evidence of active or scalable exploitation. There is no EPSS score supplied, the CVE is not in CISA KEV, and no POC is referenced, so there is no public exploit identified at time of analysis. No signals conflict; rather, all available exploitation signals (SSVC none, no KEV, no POC) uniformly indicate this is not yet being exploited, so prioritize it as part of routine patch cycles for privilege-escalation hardening rather than as an out-of-band emergency - while noting kernel LPE bugs are frequently weaponized later as the second stage of exploit chains.

An attacker who has already gained an unprivileged foothold (e.g., via phishing, a malicious document, or a compromised standard user account) runs a crafted local program that triggers the heap-based buffer overflow in the Win32 kernel subsystem to corrupt kernel heap memory and escalate from a limited user to SYSTEM. No user interaction is needed and attack complexity is low, but valid local access is a prerequisite. No public exploit identified at time of analysis, so a working exploit would currently need to be developed privately.