Windows Win32K CVE-2025-62458

Requires the attacker to already have local, authenticated access with the ability to execute code as a standard/low-privileged user on the affected Windows host (PR:L, AV:L); it cannot be triggered remotely or without a prior foothold. No user interaction is needed (UI:N) and no special non-default configuration is indicated - the vulnerable Win32K GRFX kernel component is a core part of affected Windows client (Windows 10 1607/1809/21H2/22H2, Windows 11 23H2) and server (Server 2008 R2 SP1 through 2012 R2, and per tags Server 2016/2019/2022) editions. The limiting factor is the local-access prerequisite, which confines this to post-compromise privilege escalation rather than initial access.

CVSS 3.1 base score 7.8 (HIGH) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H describes a locally-exploitable, low-complexity elevation-of-privilege requiring the attacker to already hold low-level (authenticated/PR:L) access to the target, yielding full confidentiality, integrity and availability impact (typically SYSTEM). EPSS is 0.66% (49th percentile), which is unremarkable and does not indicate imminent mass exploitation. There is no CISA KEV listing and no public exploit code identified at time of analysis, so exploitation status is: no public exploit identified at time of analysis. Signals are internally consistent: this is a classic Win32K kernel EOP - high impact but gated behind local access, so it is a second-stage/post-compromise primitive rather than an internet-facing critical. Practical priority is elevated because Win32K heap-overflow EOPs are a historically favored target for exploit developers and malware toolkits, and the huge Windows install base means broad patch urgency even absent current in-the-wild activity. No conflicting signals were found; the only limitation is the terse MSRC-style description with no technical detail on the specific GRFX code path.

An attacker who already has the ability to run code as a standard (non-admin) user - for example via phishing, a compromised low-privilege service, or an initial malware foothold - executes a program that issues crafted graphics/GDI calls to trigger the heap-based buffer overflow in the Win32K GRFX component. By grooming the kernel pool and corrupting adjacent structures, they escalate to SYSTEM, gaining full control of the host. No public proof-of-concept has been identified at time of analysis; the local, low-complexity vector (AV:L/AC:L) makes reliable weaponization plausible once details or exploits emerge.