Windows Kernel EUVD-2026-99360

Exploitation requires the attacker to already possess local, low-privileged access with the ability to execute code on the target (PR:L, AV:L) - this is a post-compromise privilege-escalation primitive, not a remote entry point. No special product feature or non-default configuration is named in the description; the vulnerable code is in the core Windows Kernel, so default installations of the affected builds are exposed. Limiting factors: the attacker must first obtain an authenticated local foothold, exploitation is local-only (not network-reachable), and the affected systems must be unpatched - fixed builds are enumerated per release (e.g. Windows 11 24H2 below 10.0.26100.9711, Windows Server 2022 below 10.0.20348.5761, Windows Server 2019 below 10.0.17763.9376).

This is a genuine but not emergency-priority issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local privilege-escalation flaw: the attacker must already have low-privileged code execution on the host (PR:L) and operate locally (AV:L), but once there, complexity is low (AC:L), no user interaction is needed (UI:N), and impact is total (C/I/A all High) - consistent with full kernel-level compromise. The signals are largely consistent across sources and point AWAY from widespread urgency: CISA's SSVC decision framework reports Exploitation=none and Automatable=no (while confirming Technical Impact=total), there is no CISA KEV listing, and no public exploit code was identified in the provided data. No EPSS score was supplied, so exploitation-probability cannot be quantified here. The combination of total technical impact with 'none' exploitation and 'no' automatable means this is a high-severity-but-currently-low-real-world-exploitation issue: dangerous as a post-compromise escalation primitive (commonly chained after phishing or initial foothold) but not a remotely wormable, mass-exploitable threat. Priority should be driven by the ubiquity of Windows rather than by any active-exploitation signal.

An attacker who has already gained low-privileged code execution on a Windows host (e.g. via phishing, a malicious document, or a compromised service account) runs a crafted program that triggers the heap-based buffer overflow in the Windows Kernel. Exploiting the corruption, they elevate from their standard user context to SYSTEM, gaining full control of the machine. No user interaction is required and attack complexity is low, but no public exploit code was identified at time of analysis.