Windows Win32 Kernel EUVD-2026-99416

Exploitation requires the attacker to already have local, interactive or code-execution access to the Windows host with at least low-level privileges (PR:L) - it cannot be triggered remotely or by an unauthenticated user. No user interaction is needed (UI:N), but the high attack complexity (AC:H) indicates a dependency on specific conditions such as timing, race windows, or particular system state that the attacker does not fully control, which limits reliability. The affected component is the default Win32 kernel subsystem present in all listed Windows 10/11 and Windows Server builds, so no special non-default configuration is required beyond running an unpatched version below the fixed build. Limiting factors: local access prerequisite, existing low privileges, and the non-trivial complexity of reliably triggering the disclosure.

This is a genuinely low-to-moderate priority issue despite the CRITICAL-sounding 'Win32 Kernel Subsystem' location. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) and base score of 4.7 (Medium) all point the same direction: local vector, high attack complexity, and low-but-nonzero privileges already required. All secondary signals are consistent rather than conflicting - SSVC rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'. No EPSS score was supplied, there is no CISA KEV listing, and no public exploit code is referenced, so there is no evidence of real-world attacks. The only elevated metric is confidentiality (C:H), which aligns with the CWE-497 information-disclosure nature - an attacker who already has a foothold could read sensitive kernel/system memory contents. Net assessment: a defense-in-depth patch, not an emergency. It is realistically useful to an attacker as a post-compromise building block (e.g., defeating KASLR or harvesting secrets) rather than as an initial-access or mass-exploitation vehicle. No key signals conflict; the main gap is the absence of an EPSS probability to corroborate the low SSVC exploitation rating.

An attacker who has already gained the ability to run low-privileged code on a Windows host (via phishing, a malicious installer, or a separate initial-access bug) executes a crafted local program that interacts with the Win32 kernel subsystem to read sensitive system information it should not be able to see. Because the flaw has high attack complexity (AC:H), success may require winning a race or satisfying specific timing/state conditions rather than a single reliable call. No public proof-of-concept is identified at time of analysis.