Windows Server 2016 CVE-2026-32164

Local authenticated user account on Windows system with access to User Interface Core components. High attack complexity requires precise timing to exploit synchronization window during concurrent resource access in privilege escalation pathway.

Real-world risk is moderate despite the 7.8 CVSS score. The local attack vector (AV:L) restricts exploitation to users with existing system access, significantly reducing exposure compared to network-based vulnerabilities. The low privilege requirement (PR:L) means any authenticated local user can attempt exploitation, but high attack complexity (AC:H) indicates successful exploitation requires specialized knowledge, precise timing, and potentially multiple attempts to win the race condition. The changed scope (S:C) with high confidentiality, integrity, and availability impact (C:H/I:H/A:H) confirms this enables full system compromise when successful. No EPSS probability data provided, but the combination of local-only access, high complexity, and authenticated requirement typically correlates with lower exploitation probability in enterprise environments with standard access controls. Absence from CISA KEV list and no public exploit code means this is not currently weaponized for mass exploitation. Priority should focus on systems where untrusted local users have access (shared workstations, terminal servers, jump boxes) or where attackers might chain this with initial access vulnerabilities. SSVC decision factors lean toward monitoring rather than emergency response given the local vector and lack of active exploitation evidence.

An attacker with low-privileged local access to a Windows system (such as a standard domain user on a corporate workstation or a limited account on a shared terminal server) executes a specialized exploit tool that repeatedly triggers UI Core operations while manipulating shared resource states. By precisely timing concurrent operations to exploit the synchronization flaw, the attacker wins the race condition and causes the vulnerable component to operate with elevated privileges, allowing arbitrary code execution in SYSTEM context. The attacker then installs persistence mechanisms, exfiltrates sensitive data, or pivots to additional network resources using the compromised high-privilege access.