Win32 Kernel Subsystem EUVD-2026-99981

Requires the attacker to already possess local, authenticated code-execution on the target Windows host (CVSS PR:L, AV:L) - i.e. an existing low-privileged session or process; there is no remote or network-facing attack surface. Once local, exploitation needs no user interaction (UI:N) and is low-complexity (AC:L) against the Win32 kernel subsystem on affected builds (e.g. Windows 11 24H2 below 10.0.26100.9711, Windows Server 2025 below 10.0.26100.33650, Windows 10 22H2 below 10.0.19044.7807, and the other enumerated SKUs). The principal limiting factor is the local-access prerequisite: this flaw cannot be exploited by an unauthenticated remote attacker and functions only as a post-access privilege-escalation step; applying the vendor patch to the listed fixed builds removes the condition.

This is a credible but second-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local privilege-escalation flaw: the attacker must already have authenticated code execution on the host (PR:L) and operate locally (AV:L), but once there, exploitation is low-complexity (AC:L), needs no user interaction (UI:N), and yields total confidentiality, integrity and availability impact - consistent with kernel use-after-free leading to SYSTEM-level control. The signals are internally consistent and point AWAY from mass exploitation: SSVC records Exploitation=none and Automatable=no (as expected for a local EoP that cannot be sprayed remotely), though Technical Impact=total aligns with the C:H/I:H/A:H kernel compromise. No EPSS score was supplied, there is no CISA KEV listing, and no public exploit is indicated, so there is no public exploit identified at time of analysis. The realistic risk profile is that of a classic post-compromise privilege-escalation primitive - valuable as the second stage of an intrusion chain (phishing/RCE foothold → kernel EoP → SYSTEM) rather than an internet-facing emergency. Because the product is Windows (ubiquitous) and Microsoft self-reported with a patch available, this warrants prompt patch-cycle inclusion but is not a drop-everything issue absent evidence of active exploitation.

An attacker who already has low-privileged code execution on a Windows host - for example via a phishing payload or a compromised user account - triggers the use-after-free in the Win32 kernel subsystem to corrupt kernel memory and elevate to SYSTEM. No user interaction is required and attack complexity is low (AC:L), but local authenticated access (PR:L, AV:L) is a prerequisite. No public exploit is identified at time of analysis.