Windows Win32k CVE-2026-57095

Exploitation requires the attacker to already have local, authenticated access with low privileges (PR:L) and the ability to execute code that reaches the Win32k subsystem - i.e., an interactive or code-execution foothold on the target Windows machine; it cannot be triggered remotely over the network. What limits exploitation: no path to unauthenticated or remote entry (AV:L), the need for an existing user-level account, and the absence of any automated/wormable vector (SSVC Automatable: no). No special non-default product feature or configuration toggle is named in the CVE - any supported, unpatched Windows build with the standard Win32k subsystem is exposed, making broad Windows deployment the main risk multiplier rather than a specific enabled feature.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U, C:H/I:H/A:H, base 7.8) describes a locally exploitable flaw requiring existing low privileges but no user interaction, with high impact once triggered. Corroborating signals temper the urgency: EPSS is only 0.50% (39th percentile), CISA SSVC lists Exploitation as 'none' and Automatable as 'no', and no KEV listing or POC is present, so this is a real but not emergency-tier issue. Note a partial inconsistency between the classification and the vector - the CVE is titled information disclosure (CWE-200) and the primary named impact is privilege escalation, yet the CVSS assigns High to all of confidentiality, integrity and availability; the I:H/A:H likely reflect the eventual EoP outcome rather than the disclosure primitive itself, so treat the info-leak as the entry point and EoP as the consequence. Overall this is a standard 'patch-in-normal-cycle' local EoP: meaningful for defense-in-depth and post-compromise chains, but not a drop-everything remote threat.

An attacker who has already gained low-privileged code execution on a Windows host - for instance via phishing, a compromised service account, or a foothold on a shared terminal server - invokes a crafted call into the vulnerable Win32k path to leak kernel memory, then leverages that disclosure to escalate to SYSTEM. No user interaction is required and the attack is entirely local; no public exploit code has been identified at time of analysis, so exploitation would currently require custom tooling.