Windows DirectX CVE-2026-58629

Exploitation requires the attacker to already have local access and low-privilege authenticated code execution on the target (CVSS PR:L, AV:L) - it cannot be triggered remotely or by an unauthenticated user, and no user interaction is needed (UI:N). The attacker must be able to run an executable that invokes the affected DirectX kernel graphics path, which is present by default on all listed Windows client and server builds, so no special product feature or non-default configuration is needed to reach the code. The primary limiting factor is the high attack complexity (AC:H): reliably exploiting the use-after-free depends on winning a memory-reuse race or achieving precise heap grooming, making exploitation non-deterministic and reducing its practicality compared with a trivially reliable escalation.

The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0) describes a local, authenticated attack requiring high complexity but yielding high confidentiality, integrity, and availability impact - consistent with a kernel privilege-escalation primitive. The AC:H rating is significant: use-after-free exploitation here likely depends on winning a race or grooming the kernel heap into a specific state, which reduces reliability and raises the bar for weaponization. No EPSS score was provided, no SSVC decision data was supplied, the CVE is not in CISA KEV, and no proof-of-concept is referenced, so the current real-world exploitation signal is low. This is a meaningful patch-priority item for privilege-escalation-in-defense-in-depth reasons (it is a common second-stage in intrusion chains) but not an emergency drop-everything issue absent evidence of exploitation. Note the tag set lists 'Denial Of Service' while the CVSS impact and description emphasize privilege elevation - the DoS tag likely reflects a secondary outcome of the memory corruption; verify the precise impact against the Microsoft advisory.

An attacker who has already gained a low-privileged foothold on a Windows host - for example through a phishing payload, a compromised service account, or an interactive session on a shared server - runs a crafted program that repeatedly exercises the vulnerable DirectX kernel path while grooming the heap to reuse the freed object. By winning the timing/reallocation condition (reflecting the CVSS AC:H rating), the attacker corrupts kernel memory to execute code as SYSTEM. No proof-of-concept is referenced in the available data, so exploitation currently requires original development effort.