Windows CVE-2025-32712

CVSS 7.8 with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates: (1) Local attack vector only—attacker must already have login access; (2) Low complexity—no special conditions or user interaction required; (3) Low privilege requirement—affects standard user accounts; (4) High impact across confidentiality, integrity, and availability. Without access to EPSS score or KEV/POC status, assessment relies on the CVSS vector: the low AC and PR:L suggest this is realistically exploitable by any authenticated user, making it a significant risk in multi-user or corporate environments where insider threats exist. The use-after-free in kernel graphics code is inherently difficult to exploit reliably but achievable through heap manipulation techniques. Real-world priority is HIGH for enterprise environments; patch urgently as this affects any user with local login capability. If EPSS is available and >0.5, or if listed in CISA KEV, prioritize immediately.

An insider or an attacker who has gained initial access through phishing or vulnerability exploitation could leverage this vulnerability locally: (1) Attacker gains shell access as standard user on Windows system (e.g., through weak credentials or prior RCE vulnerability). (2) Attacker runs a crafted exploit that triggers a use-after-free condition in Win32K GRFX by manipulating graphics objects (e.g., creating and deleting GDI handles in a specific sequence). (3) Exploit heap-sprays freed memory to gain control over the freed object's data structures. (4) Attacker escalates from standard user to SYSTEM privileges by executing kernel code through the corrupted graphics object. (5) Full system compromise follows. The low AC and lack of UI requirement means the attack can be fully automated and weaponized. If a public POC exists, risk increases significantly as commodity tools could be repurposed for widespread exploitation.