Windows Win32K CVE-2026-54107

Exploitation requires the attacker to already possess valid low-privileged local credentials or code execution on the target (CVSS PR:L, AV:L) - this is a second-stage local escalation, not a remote entry point, and cannot be triggered over the network. The key limiting factor is the race condition itself (CWE-362, reflected in AC:H): the attacker must repeatedly trigger concurrent Win32K operations and win a narrow, non-deterministic timing window, so success is probabilistic rather than guaranteed, which is why CISA rates it Automatable 'no.' No user interaction is required (UI:N). The affected feature is the Win32K GUI/kernel subsystem present by default on all listed Windows client and server editions, so no special non-default configuration is needed beyond the OS being unpatched and the attacker having an interactive or programmatic local session.

The signals collectively point to a real but not urgent local escalation issue. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) shows local access with existing low privileges required and, critically, high attack complexity - meaning the attacker must reliably win a race, which is non-deterministic. This aligns with CISA's SSVC assessment: Exploitation 'none' (no observed or public exploitation), Automatable 'no' (the race cannot be reliably scripted at scale), yet Technical Impact 'total' (successful exploitation yields full SYSTEM compromise). EPSS is low at 0.19% (9th percentile), and the CVE is not in CISA KEV. There are no conflicting signals here - every source agrees this is a high-impact-but-hard-to-exploit local EoP that is not currently being exploited. Prioritize it as a standard Patch Tuesday-class kernel fix rather than an emergency, though its total technical impact makes it a valuable second-stage primitive for adversaries who already have code execution.

An attacker who already has a foothold as a standard (non-admin) user - for example via phishing, a compromised service account, or an unprivileged shell on a shared terminal server - runs a program that rapidly and repeatedly triggers the vulnerable Win32K operation from multiple threads to win the timing window. On a successful race, kernel memory is corrupted to hijack a token or execute code at kernel level, granting SYSTEM privileges. No public exploit is identified at time of analysis, and the high attack complexity means the exploit may require many attempts to succeed.