Windows Kernel EUVD-2026-99972

Exploitation requires the attacker to already have local, authenticated access to the target host as a low-privileged user (CVSS PR:L, AV:L) and the ability to execute arbitrary local code that reaches the vulnerable kernel code path. No user interaction is required (UI:N) and attack complexity is low (AC:L) once that foothold exists. The LIMITING factor is the mandatory local presence with existing privileges - there is no remote or unauthenticated vector - so this is a post-compromise escalation primitive rather than an initial-access flaw. All supported Windows 10, Windows 11 (21H2 through 26H2), Windows Server 2022, and Windows Server 2025 builds below the patched versions listed in EUVD are affected; no non-default configuration is noted as required.

This is a moderate-severity local privilege escalation that most signals agree is NOT a top-tier priority. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms it requires local access with low-level privileges already held - an attacker must already be able to execute code on the host as an authorized user, which sharply limits mass exploitation. SSVC reinforces this: Exploitation='none' (no observed activity), Automatable='no' (cannot be reliably scripted across many targets, consistent with a local-only vector), yet Technical Impact='total' (full compromise of the component once triggered). There is no CISA KEV listing and no EPSS score was supplied, so widespread or active exploitation is not indicated - treat this as a patch-in-normal-cycle item rather than an emergency. IMPORTANT CONFLICT: the supplied CVSS vector scores impact as C:N/I:N/A:H (availability only, score 5.5), but the description states the flaw 'allows an authorized attacker to elevate privileges,' which inherently implies confidentiality and integrity impact (gaining SYSTEM). A kernel heap overflow yielding EoP would normally be C:H/I:H/A:H (~7.8). The low 5.5 availability-only scoring appears to understate true impact - verify impact metrics against the Microsoft MSRC advisory before finalizing prioritization.

An attacker who has already obtained a low-privileged foothold on a Windows host (e.g., via phishing, a compromised standard user account, or a chained initial-access bug) runs a crafted local program that triggers the heap-based buffer overflow in the Windows Kernel to corrupt kernel memory and elevate to SYSTEM. Because AC:L and UI:N, no victim interaction or special timing is needed once local code execution is achieved. No public proof-of-concept was identified in the provided data.