Windows Kernel EUVD-2026-99167

The attacker must already have local, authenticated access to the target Windows system at a low privilege level (PR:L), and must be able to execute code locally to reach the vulnerable kernel path - there is no remote or network vector (AV:L) and no user interaction is required (UI:N). Affected builds are specific Windows 11 (23H2/24H2/25H2/26H1/26H2) and Windows Server 2022/2025 kernel versions below the patched builds listed in EUVD (e.g., Server 2025 <10.0.26100.33650, Server 2022 <10.0.20348.5761); systems patched to or above those build numbers are not exploitable. The limiting factor is the requirement for prior local foothold, which confines this to post-access privilege escalation rather than initial compromise.

This is a genuine but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local, low-complexity privilege-escalation flaw requiring an attacker to already hold low-level (authenticated, non-admin) access to the host - it is not remotely reachable. The signals are internally consistent: CISA's SSVC decision shows Exploitation=none and Automatable=no, EPSS was not provided, and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation. Technical Impact=total aligns with the C:H/I:H/A:H impact (full SYSTEM/kernel compromise once triggered). The realistic risk is that this becomes a reliable second-stage escalation primitive chained after initial access (phishing, malicious binary, or a compromised low-privilege account) rather than a mass-exploited internet-facing bug. Automatable=no and AV:L mean it will not self-propagate or be sprayed at scale. Because the affected component is the Windows Kernel - present in virtually every environment - patch urgency should still be treated as high despite the absence of known exploitation, as kernel LPE flaws are historically attractive for post-compromise weaponization.

An attacker who has already gained a foothold on a Windows host as a standard (low-privileged) user - for example via a phishing payload or stolen non-admin credentials - runs a crafted program that drives the vulnerable kernel code path to overflow a heap buffer. Successful exploitation corrupts kernel memory to gain SYSTEM-level execution, fully compromising the machine. No public exploit identified at time of analysis, and no user interaction is required once local access is held.