Microsoft Windows CVE-2026-35417

The attacker must already have local, authenticated access to the target with at least low (standard-user) privileges (PR:L) and the ability to execute code that invokes Win32K syscalls - this is a post-compromise privilege-escalation primitive, not a remote entry point. No user interaction is required (UI:N) and no special non-default configuration is needed, because Win32K is present and reachable on all standard installations. Limiting factors that reduce realistic risk: exploitation is strictly local (AV:L, not network-triggerable), it is not automatable per CISA SSVC, and it requires the attacker to first obtain a valid low-privilege session on the specific vulnerable build. Server Core installations are also listed as affected, so a minimal GUI footprint does not remove the exposure.

The signals are internally consistent and point to a genuine but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local, low-complexity attack requiring existing low privileges and no user interaction, yielding total compromise of confidentiality, integrity, and availability within an unchanged scope - a classic kernel EoP. CISA SSVC aligns: Exploitation 'none', Automatable 'no' (a local vector cannot be mass-scanned or wormed), Technical Impact 'total'. EPSS is low at 0.11% (29th percentile) and the CVE is absent from CISA KEV, so there is no evidence of active exploitation. One minor tension: the input tags include 'Information Disclosure' and 'Memory Corruption' while the description and CVSS frame it purely as privilege elevation - treat the primary impact as EoP and the info-disclosure angle as a likely enabling primitive rather than a confirmed separate outcome. Overall: worth patching in the normal cycle, but not a drop-everything zero-day given no exploitation and a local-only, non-automatable vector.

An attacker who has already gained a low-privileged foothold on a Windows host - via phishing, stolen standard-user credentials, or a compromised service account - runs a crafted program that issues malicious Win32K syscalls to trigger the ICOMP type confusion, corrupting kernel memory to overwrite a process token and elevate to SYSTEM. From there they disable security tooling, harvest credentials, and move laterally. No public exploit is identified at time of analysis, so this would require the attacker to develop or acquire a working primitive.