Windows Kernel-Mode Drivers EUVD-2026-99757

Exploitation requires the attacker to already hold authenticated local access to the Windows system (PR:L) and the ability to invoke the vulnerable Windows Kernel-Mode Driver code path; no user interaction and no elevated privileges beyond a standard local account are needed (UI:N). It cannot be triggered remotely or over a network (AV:L), and SSVC Automatable=no indicates it is not reliably scriptable for mass exploitation. The practical limiting factors are the need for a pre-existing local foothold and the outcome being limited to information disclosure (C:H, I:N, A:N) - there is no code execution or system modification, so realistic use is as an auxiliary kernel-memory-leak primitive within a larger exploit chain. Affected builds span Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2012 R2 through 2025, each fixed in the vendor-listed patched build.

This is a genuinely low-to-moderate priority issue despite the information-disclosure-focused CVSS 5.5 (Medium) rating, and the signals are consistent rather than conflicting. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) describes a local, low-privilege, no-user-interaction attack yielding high confidentiality impact (kernel memory disclosure) but no integrity or availability impact. CISA's SSVC framework reinforces a non-urgent posture: Exploitation=none (no observed activity), Automatable=no (cannot be reliably mass-exploited, consistent with the local vector and the need for an existing authenticated foothold), and Technical Impact=partial. Exploitation status is: no public exploit identified at time of analysis - there is no KEV listing and no POC referenced in the provided data. No EPSS score was provided, so probabilistic exploitation likelihood cannot be factored in; absence of EPSS is a data gap, not a signal of low risk per se. The dominant limiting factor is that the attacker must already be an authenticated local user (PR:L), which narrows this to a post-compromise information-leak primitive (e.g., defeating KASLR or reading uninitialized kernel memory) rather than a standalone remote threat. Realistic priority: patch in normal monthly cadence; not an emergency.

An attacker who already has low-privileged, authenticated access to a Windows host (e.g., a standard user account or malware running in a low-integrity context) invokes an affected kernel-mode driver interface that returns a resource populated from uninitialized kernel memory. The leaked bytes may expose kernel pointers or residual sensitive data useful for defeating ASLR or chaining into a privilege-escalation exploit. No public exploit code is identified at time of analysis, and the local-only, low-complexity vector means exploitation is feasible but not remotely or automatically triggerable.