Windows Win32K CVE-2026-33840

Attacker must possess valid low-privileged user credentials (local or domain user account) and interactive or remote desktop logon access to an affected Windows system running Windows 11 24H2/25H2/26H1 or Windows Server 2025. The vulnerability is exploitable against default Windows configurations without requiring specialized features or non-standard settings. Exploitation requires ability to execute code in a user session context with access to Win32K kernel subsystem, which is standard for interactive desktop sessions. Exploitation is limited by the local attack vector (AV:L) requiring physical access, RDP/terminal services access, or prior compromise of user credentials - remote network-based exploitation is not possible. No user interaction (UI:N) is required once the attacker has established local access, and no elevated privileges beyond standard user rights (PR:L) are needed to trigger the vulnerability.

Real-world risk is moderate-to-high for organizations running affected Windows 11 and Server 2025 systems. The CVSS 7.8 score accurately reflects the local attack vector requiring low privileges (PR:L) and low complexity (AC:L) with complete system compromise potential (C:H/I:H/A:H). However, exploitation prerequisites significantly constrain practical risk: attackers must already have valid user credentials and local access to a target system, making this primarily an elevation-of-privilege vector rather than an initial access method. No CISA KEV listing indicates this is not yet observed in widespread active exploitation. No public proof-of-concept code has been identified, reducing immediate weaponization risk. EPSS probability data is unavailable for this recent vulnerability, limiting quantitative exploitation likelihood assessment. The SSVC decision framework suggests moderate priority: no confirmed exploitation (Exploitation:none), likely automatable once researched given AC:L (Automatable:yes), and total system control impact (Technical Impact:total). This is a real priority for patch deployment in enterprise environments due to kernel-level impact and straightforward exploitation path once local access exists, but not an emergency requiring immediate out-of-band patching given current exploitation status.

An attacker who has compromised a standard user account through phishing or credential theft logs into a Windows 11 24H2 workstation with low-privilege access. The attacker executes a crafted exploit targeting the Win32K ICOMP use-after-free vulnerability, triggering the memory corruption condition through malformed graphics operations. By manipulating freed kernel memory, the attacker redirects execution flow to injected shellcode running in kernel mode, granting SYSTEM-level privileges and allowing installation of persistent backdoors, credential harvesting tools, or lateral movement to other network systems.