Windows Kernel EUVD-2026-99495

Requires the attacker to already possess local, authenticated low-privilege code-execution on the target host (AV:L, PR:L); there is no remote or network-reachable vector. Exploitation hinges on winning a use-after-free race condition in the kernel, reflected by the high attack complexity (AC:H) - the attacker must reliably trigger the free-then-reuse timing window, which is non-deterministic and may require many attempts. No user interaction is needed (UI:N). The chief limiting factors are the need for prior local access and the timing-dependent race, which together make reliable, automated exploitation difficult (SSVC Automatable: no).

This is a moderate-priority local privilege escalation in the Windows Kernel (CVSS 7.0). The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U) shows the attacker must already have local, authenticated low-privilege code execution on the host and must overcome high attack complexity - consistent with a use-after-free race condition that requires precise timing to win. Impact is total (C:H/I:H/A:H), matching SSVC's 'Technical Impact: total,' since successful exploitation yields kernel-level (SYSTEM) control. However, the risk signals point toward lower real-world urgency than the severity alone suggests: SSVC reports 'Exploitation: none' and 'Automatable: no,' there is no CISA KEV listing, and no public exploit was identified in the provided data. No EPSS score was provided, so exploitation probability cannot be quantified. The AC:H and PR:L prerequisites plus non-automatable classification mean this is a second-stage/post-compromise escalation tool rather than an internet-facing emergency. Net: patch on a normal prioritized cadence; it is a genuine EoP but not currently an actively-exploited, mass-weaponizable threat.

An attacker who has already gained a foothold as a standard (low-privileged) local user - for example via phishing-delivered malware or a compromised service account - runs code that repeatedly triggers and races the vulnerable kernel object's free/reuse window. On a successful race, the dangling pointer is reclaimed with attacker-controlled data to corrupt kernel memory and elevate to SYSTEM. No public exploit code was identified at time of analysis, and the high attack complexity (race condition) makes reliable exploitation non-trivial.