Windows Kernel EUVD-2026-99767

Exploitation requires the attacker to already have local, authenticated access to the target host with at least low-level privileges (CVSS PR:L) and the ability to execute code locally - this is a privilege-escalation primitive, not a remote entry point. No user interaction is needed (UI:N) and no special non-default feature or configuration is called out in the description; any supported, unpatched Windows build in the listed version ranges (Windows 10/11 client editions 1607 through 25H2/26H2, and Windows Server 2012 through 2025, including Server Core installations) is affected by default. The principal limiting factor is the local-access and authentication prerequisite (AV:L/PR:L): a purely external, unauthenticated attacker cannot use this directly and must first obtain a foothold.

This is a genuine, patch-now priority for Windows fleets despite being a 'high' (7.8) rather than 'critical' rating. The CVSS vector (AV:L/AC:L/PR:L/UI:N) describes a low-complexity local elevation-of-privilege flaw requiring only low-level authenticated access, with full High impact to Confidentiality, Integrity, and Availability (scope unchanged) - the classic profile of a post-compromise privilege escalation used after initial foothold (phishing, commodity malware, or a low-priv service). No EPSS probability was provided in the input, and the vulnerability is NOT on CISA KEV, with no public exploit code referenced, so there is no evidence of active exploitation at time of analysis. The signals are therefore internally consistent (no conflict between CVSS local vector and the 'elevate privileges locally' description), but exploitation-likelihood telemetry (EPSS) is missing. Kernel heap-overflow EOLs in Windows are historically high-value targets that are frequently weaponized and later added to KEV once exploited, so the low-visibility exploitation signals should be read as 'not yet observed/reported' rather than 'low value' - treat as high priority given ubiquitous deployment.

An attacker who already has a low-privileged foothold on a Windows host (e.g., via phishing, a compromised standard user account, or a low-privilege service) runs a crafted program that triggers the heap-based buffer overflow in the Windows Kernel to corrupt kernel memory and gain SYSTEM privileges. Because the CVSS vector is AV:L/AC:L/PR:L/UI:N, exploitation is local, low-complexity, authenticated, and needs no user interaction. No public proof-of-concept or exploit code was identified in the provided data.