Windows LUAFV CVE-2026-50472

Exploitation requires an authenticated, low-privileged local user account on the target system - confirmed by the CVSS vector PR:L. The attack vector AV:L confirms that remote unauthenticated exploitation is not possible; the attacker must have local code execution capability (interactive logon, Remote Desktop session, or prior exploitation of a remote vulnerability providing local shell access). The high attack complexity (AC:H) indicates that exploitation is not deterministic or trivially automated - specific heap layout or timing preconditions must be satisfied before the overflow produces a controlled outcome rather than a crash. No special Windows feature, non-default configuration setting, or specific application state is mentioned in the description beyond the LUAFV driver itself, which is loaded by default on all affected Windows versions. Factors limiting exploitation: the attacker cannot reach the vulnerability from a network position without prior local access; the AC:H constraint means exploitation may require multiple attempts or a heap-grooming stage that increases detection opportunity; no UAI or custom UAC policy appears to block the vulnerable code path based on available data.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H yields a base score of 7.0, with the most consequential modifiers being AV:L (local attack surface only) and AC:H (high complexity, requiring specific memory or timing conditions for reliable exploitation). These two factors meaningfully constrain automated or mass exploitation: an attacker cannot reach this vulnerability from the network, and must satisfy non-trivial heap layout preconditions. No EPSS score was supplied in the input data, and active exploitation is neither confirmed by CISA KEV nor indicated by any public threat intelligence provided. However, local privilege escalation in a default Windows driver represents a critical post-exploitation enabler in multi-stage intrusion chains - once an attacker compromises even a low-privileged account through phishing or credential theft, this vulnerability removes the final barrier to full system control. The extraordinarily wide affected version range - from Server 2012 through current releases - means virtually any Windows endpoint or server that has not received recent patches is vulnerable, and even a mid-sized municipal IT team in kielce should treat this as urgent given how routinely unpatched Windows systems appear in enterprise asset inventories. The absence of a KEV listing or public exploit reduces immediate fire-drill urgency slightly, but the full C:H/I:H/A:H impact triad and ubiquitous deployment footprint keep real-world priority high.

A threat actor who has established a low-privileged foothold on a Windows endpoint - for example through phishing leading to execution as a standard user - triggers the LUAFV heap-based buffer overflow by issuing a crafted sequence of file operations that cause the driver to write beyond a heap buffer boundary under specific memory layout conditions. Once the kernel heap is corrupted and conditions align (satisfying the AC:H requirement), the attacker overwrites a privilege-sensitive kernel structure, escalates execution context to SYSTEM, and proceeds with credential dumping or lateral movement. No public exploit code exists at time of analysis, so exploitation currently requires bespoke kernel exploit development.