Windows Kernel EUVD-2026-99745

Exploitation requires the attacker to already possess local, authenticated access as a low-privileged user on the target Windows system (PR:L, AV:L) - this is a privilege-escalation primitive, not a remote entry point. No user interaction is required (UI:N), but the high attack complexity (AC:H) imposes a real limiting factor: the use-after-free must be triggered under a specific timing/memory state (typical of a race condition on the freed kernel object), so exploitation is not deterministic and may require repeated attempts. No special non-default Windows configuration is indicated by the description - the affected kernel code appears to be present in default installations across the listed client and server builds. The practical limits on risk are therefore the need for prior code execution on the host and the difficulty of reliably winning the race, not any optional feature toggle.

This is a genuine but not top-tier priority. The CVSS 3.1 base score of 7.0 (HIGH) is driven by total impact (C:H/I:H/A:H) typical of a kernel use-after-free, but the vector materially constrains real-world risk: AV:L requires local access, PR:L requires the attacker to already be an authenticated/low-privileged user, and AC:H signals that exploitation depends on winning a race or meeting a hard-to-control memory state. CISA's SSVC framework reinforces a measured posture: Exploitation=none (no observed in-the-wild activity), Automatable=no (cannot be reliably mass-exploited), and Technical Impact=total - i.e., if it works, the payoff is full SYSTEM-level control, but reliable triggering is non-trivial. EPSS is not provided in the input, so exploitation probability cannot be quantified here. KEV status is not present (not listed), and no POC is referenced, so this is not a confirmed actively-exploited flaw. Signals are mutually consistent rather than conflicting: a high-impact-but-high-complexity local EoP that Microsoft (the reporter, secure@microsoft.com) found internally and patched. Bottom line - patch on a normal Patch Tuesday cadence as part of standard Windows servicing; it is a real local privilege-escalation chain component but not an emergency given AC:H, local-only vector, and no evidence of exploitation.

An attacker who already has a low-privileged foothold on a Windows host (e.g., via phishing, a compromised standard user account, or a sandboxed process) runs a crafted program that triggers the kernel use-after-free, repeatedly grooming kernel memory to win the race condition and reclaim the freed object. On success, the stale pointer is leveraged to corrupt kernel memory and elevate to SYSTEM. No public exploit code is identified at time of analysis, and the high attack complexity (AC:H) means exploitation may require multiple attempts.