Windows Server 2019 CVE-2026-32165

Attacker requires low-privilege local user account access on Windows systems with vulnerable User Interface Core component. Requires specific memory conditions for successful exploitation (AC:H indicates difficult exploitation). No victim interaction needed. Affects Windows versions with the vulnerable UI Core implementation.

Real-world risk is moderate despite the 7.8 CVSS score. The vulnerability requires local access (AV:L), low privileges (PR:L), and high attack complexity (AC:H), significantly constraining the attack surface compared to remotely exploitable flaws. The scope change and high impact ratings reflect serious consequences if successfully exploited, enabling full system compromise from a low-privileged foothold. However, no public exploit identified at time of analysis and no CISA KEV listing indicates this is not being actively exploited in the wild. The high attack complexity suggests exploitation requires detailed knowledge of memory layouts and may not be reliably automatable across different Windows configurations. SSVC decision factors: exploitation status is none, automatable is unlikely due to AC:H, technical impact is total system compromise. Priority should focus on environments where local attackers have existing foothold access (multi-user systems, Terminal Server environments, or post-initial-compromise scenarios). Organizations with strict least-privilege enforcement and application sandboxing may have natural mitigations reducing real-world impact.

An attacker with low-privileged local access to a Windows 11 workstation or Windows Server 2022 system initiates a specially crafted sequence of UI operations that trigger the use-after-free condition in the Windows User Interface Core. By precisely timing memory allocations and manipulating heap layout through controlled UI interactions, the attacker redirects execution flow to malicious code, achieving SYSTEM-level privileges and full control over the compromised system. The high attack complexity suggests exploitation requires detailed reverse engineering and may need adaptation for different Windows builds or memory configurations.