Windows Kernel-Mode Drivers EUVD-2026-99929

Exploitation requires the attacker to already have local, authenticated low-privileged code execution on the target host (CVSS PR:L, AV:L); it cannot be triggered remotely or by an unauthenticated user, and no victim user interaction is needed (UI:N). The attacker must be able to reach and send crafted input to the vulnerable Windows kernel-mode driver from that context. Limiting factors: the need for a prior local foothold, the absence of any public exploit or active exploitation (SSVC Exploitation: none, not automatable), and the fact that affected hosts must be below the per-edition patched build (e.g., Windows Server 2025 <10.0.26100.33650, Windows 11 23H2 <10.0.22631.7652). This is a default-configuration kernel flaw with no special feature toggle required, so any unpatched supported Windows build is affected.

Signals are consistent and point to a genuine but non-emergency local privilege-escalation risk. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) describes a low-complexity, low-privilege local attack with total impact, which aligns with CISA SSVC 'Technical Impact: total.' However, SSVC rates 'Exploitation: none' and 'Automatable: no,' and there is no CISA KEV listing and no identified public exploit, so this is not currently under active exploitation and cannot be remotely weaponized at scale. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be factored in and should not be assumed. Note a terminology tension: the description and CWE-125 (out-of-bounds read) indicate an information-disclosure primitive, yet the CVSS and Microsoft class this as elevation of privilege with I:H/A:H - a common Microsoft pattern where a kernel memory read leaks data used to defeat mitigations and achieve code execution; verify the exact impact path with the MSRC advisory if integrity/availability impact is decision-relevant. Overall this is a patch-in-normal-cycle item: real priority for privileged/multi-user hosts, but not a drop-everything emergency absent exploitation evidence.

A local, already-authenticated low-privileged user (or malware running in that user's context) executes a crafted program that passes malformed input to a vulnerable Windows kernel-mode driver, triggering an out-of-bounds read. The leaked kernel memory is used to bypass mitigations (e.g., KASLR) and escalate to SYSTEM. No public exploit code is identified at time of analysis, and the attack requires prior local code execution, not remote access.