Windows Kernel-Mode Drivers EUVD-2026-99377

Requires the attacker to already have local authenticated access with at least a low-privileged account on the target Windows host (AV:L, PR:L) and the ability to execute code locally; no user interaction and no network access are involved (UI:N). The decisive limiting factor is the HIGH attack complexity (AC:H) tied to CWE-367: exploitation hinges on winning a time-of-check/time-of-use race against the kernel-mode driver to drive the use-after-free, which is non-deterministic and may demand many repeated attempts with no guarantee on any single run. All listed Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2016-2025 builds below the patched versions are affected in default configuration - no special feature or non-default setting is called out in the available data. These factors confine realistic risk to post-compromise local escalation on shared or multi-user systems rather than remote mass exploitation.

This is a locally-exploitable elevation-of-privilege flaw with a moderate CVSS 3.1 base score of 7.0. The vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) tells a consistent story: an attacker must already be local and hold a low-privileged authenticated account (PR:L), the attack complexity is HIGH (AC:H), and success yields full confidentiality, integrity, and availability impact on the host - consistent with kernel-level SYSTEM compromise. The AC:H rating aligns with CWE-367 (TOCTOU race condition), indicating exploitation depends on winning a non-deterministic timing window rather than a reliable single-shot trigger. CISA's SSVC framework corroborates a lower operational urgency: Exploitation=none (no observed exploitation), Automatable=no (consistent with a race that cannot be reliably scripted at scale), while Technical Impact=total matches the full CIA loss. There is NO CISA KEV listing and NO public POC referenced, so this is not a confirmed in-the-wild threat. EPSS is NOT provided in the input and therefore cannot be factored in - STATE EXPLICITLY: exploitation-probability data is missing. Net assessment: a genuine privilege-escalation primitive that matters post-compromise (second-stage breakout from a limited account to kernel), but not a drop-everything internet-facing emergency - it requires prior local footing and a difficult race win. Patch during the normal Windows servicing cycle, prioritizing multi-user and shared hosts. Note one input inconsistency to verify: the description says 'use after free' while the CWE is CWE-367 (race condition) - these are reconcilable (a race-induced UAF) but the vendor advisory should be checked for the precise mechanism.

A local attacker with an ordinary authenticated user account runs a purpose-built program that repeatedly races a Windows kernel-mode driver, exploiting a time-of-check/time-of-use window to trigger a use-after-free in kernel memory. On a successful race, the freed object is reclaimed with attacker-controlled data, yielding code execution in kernel context and elevation to SYSTEM. No public exploit is identified at time of analysis, and the HIGH attack complexity means many attempts may be required before the race is won.