Windows Win32K CVE-2026-54112

Exploitation requires the attacker to already possess local, authenticated low-privileged code execution on the target (CVSS PR:L, AV:L) - this is a privilege-escalation primitive, not a remote entry point, and cannot be triggered over the network or by a remote unauthenticated actor. Success further depends on winning a race condition in Win32K (AC:H), meaning the attacker must repeatedly and precisely time concurrent operations to hit a non-deterministic window; there is no special product feature or non-default configuration that must be enabled, since Win32K is a core component present on all listed builds. Limiting factors that reduce realistic risk: the need for an existing local foothold, the timing-dependent unreliability of the race (SSVC Automatable 'no'), that no victim user interaction is involved (UI:N), and that the affected build must be below the fixed patch level listed by Microsoft.

The signals are internally consistent and point to a real-but-not-emergency local EoP. CVSS 7.0 with AV:L/AC:H/PR:L/UI:N/S:U and C:H/I:H/A:H means an attacker must already be running code as a low-privileged user and must win a timing-sensitive race (high complexity), but success yields full compromise. SSVC agrees: Exploitation 'none', Automatable 'no', but Technical Impact 'total' - the AC:H and non-automatable rating are the main things holding real-world urgency down. EPSS of 0.16% (5th percentile) reinforces low near-term exploitation probability, and the CVE is not on CISA KEV. This is a patch-in-normal-cycle item rather than a drop-everything issue, though the 'total' technical impact means it is valuable as a post-exploitation step in a chain and should not be deferred indefinitely, especially on multi-user or terminal-server hosts.

An attacker who already has a low-privileged foothold - for example a standard user account, a compromised service, or code delivered via a separate phishing/RCE step - runs a program that repeatedly triggers the racing Win32K syscalls to hit the narrow timing window. On a successful race they corrupt kernel object state and escalate to SYSTEM, then use that access to disable defenses, install persistence, or move laterally. No public exploit is identified at time of analysis, and the high attack complexity means the attacker may need many attempts to win the race.