Windows DirectX CVE-2026-50353

Exploitation requires the attacker to already have authenticated local code-execution on the target (PR:L) - a standard user account or an existing malware foothold is sufficient; no administrative rights and no user interaction (UI:N) are needed. The attacker must be able to invoke the vulnerable Windows DirectX kernel graphics interface locally (AV:L), which is reachable by normal unprivileged processes on the affected builds (Windows 11 24H2/25H2/26H1, Windows Server 2025). Limiting factors: there is no remote/network path, so an attacker with zero prior access cannot use this directly; exploitation is constrained to the enumerated Windows 11 and Server 2025 versions, and reliability depends on winning the memory-reallocation race inherent to a use-after-free. Server Core installations are affected but present a smaller local-user attack surface than interactive desktops or session hosts.

The signals are consistent and point to a genuinely actionable local EoP rather than an inflated high-CVSS issue. CVSS 3.1 base is 7.8 with AV:L (local), AC:L (low complexity), PR:L (attacker already has some access), UI:N, and full C:H/I:H/A:H - a classic SYSTEM-escalation profile from a foothold. There is no EPSS score, no CISA KEV listing, and no evidence of public POC in the provided data, so real-world exploitation is currently unproven and likely low-volume; however, DirectX kernel UAF bugs are historically attractive to attackers for post-compromise escalation and are frequently reverse-engineered from patches. Note a minor tension: the tags include 'Denial Of Service' while the CVSS marks A:H and full C/I impact - the primary documented consequence is privilege elevation, and DoS should be treated as a secondary manifestation of the same memory corruption. This is a patch-promptly item for endpoints and RDP/session-host servers where untrusted users can run code, but not an internet-facing emergency.

An attacker who already has a low-privileged foothold on a Windows 11 24H2 workstation - for example via a phishing-delivered user-context malware or a compromised standard account - runs a crafted program that repeatedly exercises the vulnerable DirectX kernel path to trigger the use-after-free and groom kernel memory. By reallocating the freed object with attacker-controlled data, they corrupt kernel state to execute code as SYSTEM, then disable defenses and move laterally. No public POC is identified in the provided data, but the local, low-complexity, no-user-interaction vector makes reliable exploitation plausible once technical details are reverse-engineered from the patch.