Windows Kernel EUVD-2026-99871

Exploitation requires the attacker to already have an authenticated, low-privileged local session on the target Windows host (AV:L, PR:L) - this is not remotely reachable and cannot be triggered by an unauthenticated or network-based attacker. No user interaction is required (UI:N) and no special non-default feature or configuration is named in the description; any supported-but-unpatched Windows build listed in the EUVD affected ranges (Windows 10/11 all versions through 26H2, Windows Server 2012 through 2025 including Server Core) is affected. The primary limiting factors are the mandatory prior local foothold and existing authentication, which reduce this to a post-compromise information-disclosure primitive rather than an initial-access vulnerability.

The input CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5 Medium) describes a locally-exploitable information-disclosure flaw in the Windows Kernel requiring an already-authenticated low-privileged user; there is no integrity or availability impact. No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was provided, so exploitation probability signals are absent rather than low - this is 'no public exploit identified at time of analysis.' The local attack vector and PR:L requirement meaningfully constrain real-world risk: an attacker must already have code-execution or an authenticated session on the host, which makes this a secondary/privilege-escalation-support issue (kernel memory or system-info leak that can defeat KASLR or feed a follow-on exploit) rather than a standalone remote threat. Net: a legitimate patch-priority item for a ubiquitous product, but NOT an emergency - the Medium rating is consistent with the signals, and nothing in the data elevates it to high real-world risk. Missing data to note: no EPSS, no KEV, no POC status, and the MSRC advisory contents were not provided, so only the NVD/EUVD-derived vector and CWE could be analyzed.

A local attacker who has already gained a low-privileged authenticated foothold on a Windows host (e.g., via phishing-delivered malware or a compromised standard user account) runs code that queries the vulnerable kernel interface to read sensitive system information such as kernel memory addresses or other data outside its authorized sphere. The leaked information is then used to bypass mitigations like KASLR and support a subsequent privilege-escalation or code-execution exploit. No public exploit code was identified in the provided data, and local access plus valid credentials are prerequisites.