Windows Kerberos EUVD-2026-99417

Exploitation requires the attacker to already possess authenticated, low-privileged local access to the target host (CVSS PR:L, AV:L) - this is a post-compromise privilege-escalation primitive, not a remotely reachable flaw. The specific prerequisite is the ability to invoke the vulnerable Windows Kerberos code paths and trigger the use-after-free condition; no special non-default configuration is named in the description, so default Windows installations running the affected builds are susceptible. The primary limiting factor is the high attack complexity (AC:H): the use-after-free must be won through a timing/race window, making reliable exploitation difficult, and there is no user interaction required (UI:N) but also no remote or unauthenticated path.

This is a credible but second-tier priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0 HIGH) describes a local privilege-escalation flaw: the attacker must already have a foothold as an authenticated low-privileged user (PR:L), execute locally (AV:L), and overcome high attack complexity (AC:H) - consistent with winning a timing/race window typical of use-after-free (CWE-416) bugs. The SSVC decision framework corroborates a measured posture: Exploitation=none and Automatable=no, but Technical Impact=total (matching C:H/I:H/A:H, i.e. full compromise of the local system once exploited). There is no CISA KEV listing and no public exploit (no public exploit identified at time of analysis), so there is no evidence of active exploitation. No EPSS score was supplied in the input, so exploitation probability cannot be quantified here - this is a data gap, not a signal of low risk. The signals are internally consistent (local, hard-to-exploit, high impact, no known exploitation), so this is a patch-in-normal-cycle item rather than an emergency, but because it affects the Windows Kerberos component across virtually all supported Windows client and server builds, it is a valuable post-compromise escalation primitive and should be prioritized above typical HIGH issues on multi-user and server hosts.

An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing, a compromised service account, or a standard user login) triggers the use-after-free in the Kerberos component by racing a specifically timed sequence of operations. Successful exploitation corrupts kernel/service memory and lets the attacker elevate to SYSTEM-level privileges. No public proof-of-concept or exploit code has been identified at the time of analysis, and the high attack complexity (AC:H) means exploitation requires reliably winning a memory-reuse race.