Windows Win32 Kernel EUVD-2026-99881

Exploitation requires the attacker to already possess authenticated local access with low privileges (PR:L) on the affected Windows system - it cannot be triggered remotely or by an unauthenticated user. As a TOCTOU race condition, successful exploitation further depends on reliably winning a timing window between the kernel's security check and its use of the resource, which typically demands repeated attempts and favorable scheduling. No specific non-default feature or configuration setting is named in the description; the flaw resides in the default Win32 kernel subsystem present on all listed Windows client and server builds below the patched versions. Impact is limited to information disclosure, with no integrity or availability effect.

This is a moderate-severity, low-priority issue in practice. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a locally-exploitable flaw requiring existing low-level privileges and yielding only information disclosure (C:H, no integrity or availability impact). All exploitation-pressure signals point downward and agree with each other: there is no CISA KEV listing, no public exploit code was provided, and CISA SSVC explicitly rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'. One internal inconsistency is worth flagging: the vulnerability is a TOCTOU race condition (CWE-367), which normally implies the attacker must win a timing window, yet the input vector lists AC:L (low complexity) - race conditions typically justify AC:H, so the real attack complexity is likely understated by the input score. Net assessment: a legitimate patch-worthy local privilege/info-disclosure bug, but not an urgent, internet-facing or wormable threat; prioritize via routine Patch Tuesday cycles rather than emergency response.

An attacker who already has a low-privileged foothold on a Windows host (e.g., a standard user account or a sandboxed process) runs a program that repeatedly races the Win32 kernel subsystem, exploiting the window between a security check and the use of the resource to read kernel or cross-privilege memory contents it should not see. Winning the race reliably usually requires many attempts, and no public exploit code was identified at time of analysis.