Windows DirectX CVE-2026-50375

Exploitation requires the attacker to already have local, authenticated code-execution ability on the target (CVSS PR:L, AV:L), i.e. the ability to run a malicious binary as at least a standard user - this is a privilege-escalation primitive, not a remote entry point. No user interaction is needed (UI:N) and the attack targets default configurations of Windows/Windows Server with DirectX present, so no special feature flag or non-default setting is required. Limiting factors: the attacker must first obtain a local foothold, cannot exploit it purely over the network, and reliability depends on successfully grooming and overflowing the kernel heap; SSVC rates it not automatable, so exploitation is per-host rather than mass-scalable. Highest-risk deployments are multi-user systems (RDS/terminal servers, shared workstations, VDI) where untrusted users can execute code.

The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating local access and low existing privileges are required but no user interaction, yielding total system impact - a classic local elevation-of-privilege profile. CISA's SSVC framework aligns with a lower-urgency but serious picture: Exploitation is 'none' (no observed or public exploitation), Automatable is 'no' (consistent with the local, per-host attack vector), yet Technical Impact is 'total,' reflecting full SYSTEM compromise once exploited. EPSS is 1.50% (71st percentile), which is unremarkable and reinforces that mass, automated exploitation is unlikely; this is not KEV-listed. The signals are internally consistent rather than conflicting: high technical impact but constrained reach. This should be prioritized as a standard-cadence patch for a privileged local EoP, not an emergency, though it is a valuable post-compromise or malware privilege-escalation primitive and warrants prompt patching on multi-user, terminal-server, and shared workstation systems where untrusted users can execute code.

An attacker who already has a foothold as a standard (low-privileged) user - for example via phishing, a compromised service account, or an untrusted user on a shared/RDP host - runs a crafted program that submits malformed DirectX buffers to trigger the heap overflow in the graphics kernel. By grooming the heap and corrupting adjacent kernel structures, the attacker elevates to SYSTEM and takes full control of the machine. No public exploit is identified at time of analysis, and success requires local code execution and reliable heap manipulation.