Windows Graphics Kernel CVE-2026-102194

Exploitation requires the attacker to already possess authenticated low-privilege local access (PR:L) to the target Windows host and the ability to execute code that invokes the vulnerable Graphics Kernel code path; there is no remote or network vector and no user interaction is needed (UI:N). The decisive limiting factor is high attack complexity (AC:H): the use-after-free likely depends on winning a race condition or achieving reliable kernel-heap grooming of the freed object, so exploitation is not deterministic and may require multiple attempts. No special non-default feature or configuration is identified in the description - the affected component is a core Windows kernel subsystem present by default - so the primary barriers to exploitation are the pre-existing local foothold and the technical difficulty of the memory-corruption primitive, not an unusual deployment mode.

This is a local privilege-escalation use-after-free (CWE-416) in the Windows Graphics Kernel with a CVSS 3.1 base of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The signals point to a moderate rather than top-tier priority: the local attack vector (AV:L) and required low-level privileges (PR:L) mean an attacker must already have authenticated code-execution on the host, and the high attack complexity (AC:H) indicates exploitation depends on winning a race or grooming kernel memory reliably rather than a deterministic one-shot trigger. The impact is severe once triggered - full confidentiality, integrity and availability loss (C:H/I:H/A:H) consistent with SYSTEM-level kernel compromise. No EPSS score, KEV listing, SSVC decision, or POC is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: a credible local EoP primitive for post-compromise escalation (a common building block in exploit chains against Windows), but the local-only vector plus AC:H make mass or remote opportunistic exploitation unlikely. Key missing signals (EPSS, KEV, POC) should be monitored, as kernel graphics UAFs historically attract reliable exploit development over time.

An attacker who has already gained low-privileged local code execution on a Windows host (e.g., via phishing or a compromised standard user account) runs a crafted program that manipulates Graphics Kernel objects to trigger the use-after-free, then grooms the freed kernel allocation to gain arbitrary kernel read/write and elevate to SYSTEM. Because AC:H applies, the attacker likely must win a timing race or repeat the attempt, but success yields full control of the machine. No public exploit is identified at time of analysis.