Microsoft Windows CVE-2026-40403

Exploitation requires the attacker to already have authenticated, low-privileged local code execution on the target (CVSS PR:L, AV:L) - this is a post-compromise privilege-escalation vulnerability, not a remote entry point. The specific requirement is the ability to reach the Win32K GRFX (graphics) kernel code path, which any interactive or logged-on user process can normally do, and no user interaction is needed (UI:N) with low attack complexity (AC:L). Limiting factors: the attacker must first obtain a foothold on the machine, the vulnerable Windows build must be unpatched (below the fixed builds listed in EUVD), and SSVC rates it non-automatable, so it is used in targeted hands-on-keyboard or malware-chained escalation rather than wormable mass exploitation. Hosts where untrusted users cannot run code are not practically exposed.

The signals are internally consistent and point to a serious-but-not-emergency local escalation issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 8.8) indicates local access, low complexity, low privileges, no user interaction, and a scope change with total CIA impact - the classic profile of a kernel LPE. SSVC corroborates this: Technical Impact is 'total,' but Exploitation is 'none' and Automatable is 'no,' meaning no observed exploitation and no reliable mass-automation path (local vector requires an existing foothold). EPSS reinforces low near-term exploitation likelihood at 0.02% (6th percentile). It is not on CISA KEV. The high CVSS is driven by impact severity, not by ease of remote reach - this is a privilege-escalation building block an attacker uses AFTER initial access, not an internet-facing entry point. Realistic priority: patch in the normal Patch Tuesday cycle, prioritizing multi-user, RDP/terminal, and shared-workstation hosts where untrusted low-privileged users run code.

An attacker who already has a low-privileged foothold on a Windows host - for example a standard domain user on a shared terminal server, or malware running in a restricted user context - invokes a crafted graphics/Win32k GRFX operation that overflows a kernel heap buffer. By grooming the kernel heap and corrupting an adjacent object, they gain arbitrary kernel code execution and elevate to SYSTEM, defeating the local privilege boundary. No public exploit is identified at time of analysis, and no user interaction is required once the attacker can execute code locally.