Windows Kernel EUVD-2026-99329

Exploitation requires the attacker to already possess local, authenticated access with the ability to execute code as a standard (low-privileged) user on an affected Windows build (per CVSS AV:L/PR:L); no user interaction is needed (UI:N). The flaw is in the Windows Kernel itself and affects default installations across the listed client and server builds, so no special feature or non-default configuration is required to reach the vulnerable code. The primary limiting factors are the need for a pre-existing local foothold (it cannot be triggered remotely or network-side) and that successful UAF exploitation on modern Windows must bypass kernel mitigations, which raises practical difficulty beyond the AC:L rating.

Signals are largely consistent and point to a moderate, not emergency, priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local, low-complexity, low-privilege (authenticated) escalation with total impact on confidentiality, integrity and availability within the vulnerable scope. CISA's SSVC framework reinforces this: Exploitation=none (no observed or public exploitation), Automatable=no (local-only, not mass-scannable), Technical Impact=total - meaning high consequence but constrained reach. There is no CISA KEV listing and no POC indicator in the provided data, and EPSS was not supplied. The absence of EPSS means widespread-exploitation probability cannot be quantified from this input. Overall this is a credible local privilege-escalation primitive (classic Windows Kernel use-after-free) that is valuable as a post-compromise step but requires an attacker to already have authenticated local code execution; it is a real patch-priority item for a monthly cycle rather than a drop-everything, actively-exploited threat. No signals conflict, though note the 'Denial Of Service' tag understates the impact, since the description and CVSS (C:H/I:H) indicate full privilege elevation, not merely availability loss.

An attacker who already has low-privileged authenticated access to a Windows host (e.g., via phishing, a compromised standard user account, or a sandboxed process) runs a crafted program that manipulates kernel object lifetimes to trigger the use-after-free. By controlling the freed-then-reused kernel memory, they execute code in kernel context and elevate to SYSTEM. No public exploit identified at time of analysis, so weaponization would require independent development.