Windows Server 2019 CVE-2026-32162

Local system access required. Windows COM subsystem must be active. Attacker must ability to create or register COM objects in accessible registry paths. No authentication required for local COM invocation.

The CVSS vector reveals critical characteristics: local attack vector (AV:L) limits exploitation to attackers with physical or RDP access, but low complexity (AC:L) and no privilege requirements (PR:N) mean any unprivileged local user can exploit this. No user interaction (UI:N) enables scripted attacks. High impact across confidentiality, integrity, and availability (C:H/I:H/A:H) with unchanged scope (S:U) indicates full system compromise within the original security context. Without EPSS data provided, we rely on observable signals: vendor patch availability suggests Microsoft views this as credible risk warranting immediate remediation. The absence of CISA KEV status and no identified public exploit code indicate this is not yet weaponized in the wild, providing a remediation window. However, CWE-349 flaws in privileged Windows components have historically been reverse-engineered from patches within weeks. The authentication bypass tag combined with low attack complexity makes this automatable once an exploit is developed. SSVC framework assessment: exploitation is possible (patch-gap attacks likely), not automatable yet, technical impact is total (privilege escalation to SYSTEM). Priority: high for organizations with untrusted local users (shared workstations, terminal servers, multi-tenant environments); moderate for single-user endpoints with robust physical security.

An unprivileged local user crafts a malicious COM object embedding untrusted data alongside trusted parameters. When the COM subsystem processes this hybrid object, it fails to properly validate data boundaries, allowing code execution with SYSTEM privileges.