Windows Graphics Kernel CVE-2026-50493

Exploitation requires the attacker to already have local code-execution as a low-privileged authenticated user (CVSS PR:L) on an affected Windows build - this is a privilege-escalation bug, not a remote-entry point, so it cannot be triggered over the network or without an existing foothold. No user interaction is needed (UI:N) and attack complexity is low (AC:L), meaning that once a local account is available, the trigger is reliable against default configurations of the Windows Graphics Kernel with no special feature-enablement required. The limiting factors are therefore: the attacker must possess valid local logon (interactive, RDP, or a running low-priv process), and the host must be an unpatched supported build (Windows 10 1809 through Windows 11 26H1, or Windows Server 2019 through 2025). Highest realistic exposure is on multi-user/session hosts where untrusted users legitimately hold local accounts.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a locally-exploitable, low-complexity, low-privilege bug with total confidentiality/integrity/availability impact - the classic LPE profile. It is not a remote-entry vulnerability: an attacker must already be able to run code on the host, so it is a second-stage escalation primitive rather than an initial-access flaw. No EPSS score, KEV listing, or SSVC decision data was provided, so probability-of-exploitation cannot be quantified from the input; there is currently no public exploit identified. That said, Graphics Kernel/win32k-class use-after-free bugs are a historically favored and reliably weaponizable target for exploit developers, so despite the 'Important' (not Critical) severity this should be treated as a real patching priority, especially on multi-user, RDP, and terminal/session hosts where untrusted users hold local footholds. Note the Tags list 'Denial Of Service' as an impact even though the CVSS models full C/I/A high - memory corruption can manifest as either a crash or code execution; treat the EoP-to-SYSTEM outcome as the governing risk.

An attacker who has already gained a low-privileged foothold on a Windows host - for example through phishing, a compromised service account, or a malicious insider - runs a crafted program that drives the Graphics Kernel into a use-after-free, grooms the freed kernel object, and overwrites kernel structures to gain SYSTEM privileges. Given AV:L/AC:L, exploitation is local and low-complexity and requires no user interaction; no public proof-of-concept has been identified at time of analysis, but win32k/Graphics-Kernel UAF bugs are historically reliable to weaponize.