Windows Win32k CVE-2026-102208

Requires the attacker to already possess local, authenticated low-privileged access (PR:L) to the target Windows host and the ability to execute code that reaches the vulnerable Win32k kernel path. The high attack complexity (AC:H) reflects a use-after-free that depends on winning a race condition or achieving a specific memory-reclamation state, making exploitation timing-sensitive and not guaranteed on each attempt. There is no remote vector (AV:L) and no user interaction is needed (UI:N); the key limiting factors are the prerequisite local foothold and the non-deterministic race, which together confine this to post-compromise privilege escalation rather than initial access.

This is a locally-exploitable use-after-free (CWE-416) in the Windows Win32k kernel subsystem leading to privilege escalation. The provided CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 HIGH) indicates an attacker must already have local, low-privileged code execution and must win a race or meet specific timing/memory-state conditions (AC:H), which materially lowers reliability and real-world urgency compared to a network-reachable flaw. No EPSS score, KEV listing, or POC indicator was supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The realistic signal here is a classic second-stage local EoP primitive: not an initial-access risk, but valuable to malware and post-exploitation chains on an already-compromised host. The AC:H condition and absence of exploitation signals suggest this is a genuine but not emergency priority - patch in routine cadence unless you have evidence of local-attacker presence. Note the input Tags include 'Denial Of Service', which conflicts with the description's privilege-escalation outcome; the A:H impact could support a DoS side effect, but the primary impact per Microsoft's description is EoP - verify intended impact with the MSRC advisory.

An attacker who already has a foothold as a standard/low-privileged user on a Windows system runs a crafted program that triggers the use-after-free in the Win32k kernel subsystem, winning the required race condition to reclaim the freed object with attacker-controlled data and corrupt kernel memory. Successful exploitation yields SYSTEM-level privileges, enabling full host compromise. No public exploit code is identified at time of analysis, and the high attack complexity (AC:H) makes reliable exploitation non-trivial.