Windows Kernel EUVD-2026-99636

Exploitation requires the attacker to already have authenticated, low-privileged local code execution on the target (PR:L, AV:L) - this is a post-compromise privilege-escalation primitive, not a remote entry point. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so no special timing or race-window is implied by the vector. The affected component is the Windows Kernel in default configurations; the limiting factors are the need for a prior local foothold and that unpatched builds below the fixed revisions must be running (e.g., Windows 11 24H2 below 10.0.26100.9711, Server 2022 below 10.0.20348.5761, Server 2016 below 10.0.14393.9612). No special feature toggle or non-default setting is called out in the description.

The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a locally-exploitable, low-complexity use-after-free (CWE-416) in the Windows Kernel that an already-authenticated low-privilege user (PR:L) can leverage to gain full confidentiality, integrity and availability impact - classic local privilege escalation to SYSTEM. There is no EPSS score, no CISA KEV listing, and no public POC indicated in the provided data, so this is 'no public exploit identified at time of analysis.' SSVC-style reasoning: exploitation is not known to be automatable (local access with an authenticated foothold is a prerequisite), but technical impact is total. The signals are internally consistent - nothing here conflicts: AV:L matches a kernel EoP, and PR:L correctly reflects that a local foothold is needed. In practice this is a meaningful priority for patching despite not being a remote/wormable issue, because kernel UAF EoP bugs are a staple second stage in real intrusions (after phishing or a browser compromise) and historically graduate to in-the-wild exploitation; however, with no KEV/POC/EPSS data it should be treated as a high-priority patch-management item rather than an active-exploitation emergency. Note the 'Denial Of Service' tag is plausible given a kernel UAF but the described primary impact is privilege elevation, not DoS.

An attacker who has already obtained low-privileged code execution on a Windows host (e.g., via phishing, a malicious document, or a compromised standard user account) runs a crafted program that triggers the kernel use-after-free, corrupting kernel memory to execute code in kernel context and elevate to SYSTEM. No public exploit code is identified at time of analysis, and the low attack complexity (AC:L) with no user interaction (UI:N) means a reliable exploit, once developed, would be straightforward to run as a post-compromise escalation step.