Windows Kernel EUVD-2026-99771

Exploitation requires local code execution on the target as an already-authenticated low-privileged user (PR:L, AV:L) - there is no remote or network path and no victim user interaction is needed (UI:N). The high attack complexity (AC:H) indicates a meaningful limiting factor: the attacker must reliably trigger and win the use-after-free condition in the kernel (a timing/race-sensitive memory-reuse window), so successful exploitation is not guaranteed on each attempt. Affected builds span Windows 10 (21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2019/2022/2025 below the patched build numbers listed in the EUVD data; systems patched to the fixed builds (e.g., 10.0.26100.9711 for Win11 24H2) are not exploitable. The key limiting factors for defenders: attacker needs an existing local foothold and an authenticated account, and must overcome a non-trivial race condition.

Signals point to a genuine but non-emergency privilege-escalation risk. The CVSS 3.1 base score of 7.8 (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects total compromise of a system (C:H/I:H/A:H, scope change) but is tempered by three limiting metrics: local-only attack vector (AV:L), high attack complexity (AC:H, consistent with a timing/race-dependent use-after-free), and a requirement for an existing low-privileged foothold (PR:L). CISA's SSVC decision framework corroborates lower urgency: Exploitation=none and Automatable=no, meaning no observed exploitation and no reliable mass-automation path, even though Technical Impact=total agrees with the high CVSS impact metrics. There is no CISA KEV listing and no public exploit identified, so this is not confirmed in-the-wild activity. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be factored in and should be checked separately. Net assessment: a legitimate high-severity local EoP suitable for standard prompt patch-cycle prioritization (it is a useful post-compromise/second-stage primitive to reach SYSTEM), rather than a drop-everything emergency. One data inconsistency to flag: the input Tags include 'Denial Of Service', but the description and CVSS (I:H, privilege elevation) describe code-execution/privilege escalation as the primary impact - treat the DoS label with caution and verify against the MSRC advisory.

An attacker who already has a low-privileged authenticated session on a Windows host (e.g., via phishing, a standard user account, or a prior foothold) runs crafted code that triggers a use-after-free in the Windows Kernel. By winning the race condition implied by the high attack complexity and controlling the reallocated freed object, the attacker corrupts kernel memory to elevate to SYSTEM. No public exploit is identified at time of analysis, and no user interaction by a victim is required.