Windows Kernel EUVD-2026-99920

Exploitation requires physical access to the target device (CVSS AV:P) to interact with the vulnerable Windows Kernel Mode Driver and deliver the crafted input that causes the integer overflow. No authentication is required (PR:N) and no user interaction is needed (UI:N), so any hands-on attacker - including at a locked, kiosk, or unattended machine - can attempt it against default configurations of affected Windows client and server builds (e.g., Windows 11 24H2 before 10.0.26100.9711, Windows Server 2025 before 10.0.26100.33650, Windows 10 21H2 before 10.0.19044.7807). The primary limiting factor is the physical-access requirement, which prevents remote or scalable/automatable exploitation (SSVC Automatable: no); applying the available vendor patch removes the condition entirely.

This is a genuinely moderate-priority issue despite the CRITICAL-sounding 'total' technical impact. The CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N) scores 6.8 (Medium), and the dominant limiting factor is the Physical attack vector (AV:P): an attacker must have hands-on access to the target machine, which dramatically reduces the exploitable population versus a network or even local flaw. All exploitation signals point the same direction and are consistent with each other: CISA's SSVC framework reports Exploitation: none (no observed or public exploitation), Automatable: no (physical access cannot be scripted at scale), and Technical Impact: total (full SYSTEM/kernel compromise once triggered). There is no CISA KEV listing and no EPSS score was supplied in the input, so widespread opportunistic exploitation is not indicated - the realistic threat model is a targeted, hands-on attacker (e.g., evil-maid, kiosk/lab machine, or insider with device access). No conflicting signals were found: the Medium CVSS, SSVC 'none/no', and absence of KEV/POC all agree that this is a high-impact-but-hard-to-reach kernel EoP rather than an urgent mass-exploitation event. Note EPSS data was not provided, so probability-of-exploitation cannot be quantified here.

An attacker with physical access to a locked or kiosk Windows machine connects to or interacts with a vulnerable kernel-mode driver (for example via a malicious peripheral or local I/O path) and supplies crafted input that triggers an integer overflow (CWE-190) in the driver. The overflow corrupts kernel memory, allowing the unauthorized attacker to elevate from no/low privileges to SYSTEM-level kernel control. No public exploit code was identified in the provided data, and the physical-access requirement (AV:P) makes this an evil-maid / insider-style scenario rather than remote compromise.