Windows Win32K CVE-2026-58632

Exploitation requires the attacker to already have local access to the target with low-level privileges (CVSS PR:L) - i.e., the ability to execute code as a standard authenticated user on an affected Windows 10/11 or Windows Server 2016-2025 system; it cannot be triggered remotely over the network (AV:L) and needs no user interaction (UI:N). The limiting factors are therefore the prerequisite of prior local code execution and a valid (even unprivileged) account on the host; no special product feature or non-default configuration is called out in the description, so default-configured affected Windows builds with the Win32K GUI subsystem present are exploitable once local access is obtained. Systems where untrusted users cannot run code (kiosk lockdown, strict application control, no interactive/terminal logon) materially reduce realistic exposure.

The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a high-impact but locally-scoped issue: exploitation requires local access and low existing privileges, but no user interaction, and yields full confidentiality, integrity, and availability compromise (SYSTEM). No EPSS score, SSVC decision, KEV entry, or POC was provided, so real-world exploitation probability cannot be quantified from the input - the signals available point to a serious-but-not-yet-actively-exploited privilege-escalation bug. Win32K use-after-free flaws are a recurring, attractive target for local-privilege-escalation exploit developers and are frequently chained after initial access, so despite the 'local' vector this class warrants prompt patching; however, the absence of KEV/POC/EPSS data means priority should be driven by exposure to untrusted local code execution rather than by confirmed in-the-wild activity. Note the input tags mention 'Denial Of Service' while the CVSS and description emphasize privilege elevation - treat the primary impact as EoP and verify DoS as a secondary effect with the vendor advisory.

An attacker who has already gained low-privileged code execution on a Windows host - for example through a phishing payload, a compromised service account, or a low-privilege RDP/terminal session - invokes a crafted sequence of Win32K syscalls to trigger the use-after-free, reclaims the freed kernel object with controlled data, and hijacks execution to elevate to SYSTEM. This local, no-user-interaction, low-complexity path is a classic second-stage escalation used to move from initial foothold to full host compromise. No public exploit was identified at time of analysis.