Windows Win32K CVE-2026-44803

Attacker must already be able to run code in a local user context on the target Windows machine and must induce the victim to perform an action that reaches the vulnerable Win32K GRFX code path (UI:R) - typically opening, previewing or rendering a specially crafted graphics resource such as a document, image, font, or shortcut. No prior authentication to a separate service is required (PR:N), and attack complexity is low (AC:L), but the bug is not remotely reachable over the network (AV:L) and cannot be triggered without user interaction, which limits worm-style or fully unattended mass exploitation. Specific affected Windows builds and any non-default configuration requirements must be confirmed from the MSRC advisory once published.

The CVSS vector AV:L/AC:L/PR:N/UI:R describes a local attack that requires a victim to perform some action (e.g. open a crafted file or visit a malicious resource that triggers the vulnerable graphics path), with low attack complexity and no prior privileges; impact is High across the C/I/A triad consistent with kernel-level compromise. There is no KEV listing and no POC referenced in the supplied data, so this is no public exploit identified at time of analysis. EPSS data was not provided, so probabilistic exploitation likelihood cannot be quoted. Win32K integer/graphics bugs have a strong historical pattern of being weaponized for local privilege escalation in commodity malware and targeted intrusions, so despite the 'local + UI' constraints this should be treated as a meaningful EoP risk rather than a low-priority issue; the PR:N value is notable - it implies the attacker need not already be authenticated on the target before the overflow path is reachable, though local code execution context is still required per AV:L, a combination worth verifying against the eventual Microsoft advisory.

An attacker delivers a malicious document, font file, image, or shortcut to a target user (for example via phishing or a drive-by download); when the user opens or previews the content, a crafted graphics primitive is parsed by Win32K GRFX, triggering the integer overflow and corrupting kernel memory. The attacker uses the resulting primitive to elevate from the user's session to SYSTEM, enabling credential theft, persistence, or lateral movement on the host.