Windows Graphics Kernel CVE-2026-61346

Exploitation requires a low-privileged authenticated local account on the target system (PR:L per CVSS vector), meaning the attacker must already have interactive or remote-desktop access as a standard user - unauthenticated remote exploitation is not possible. The High Attack Complexity (AC:H) indicates the attacker must win a kernel-level race condition or achieve a specific heap memory layout before the freed graphics kernel object is overwritten with controlled data; this is not a single-step, fire-and-forget trigger. The vulnerability is within the Windows Graphics Kernel subsystem, so a Win32 session capable of issuing graphics API calls is implicitly required; Server Core installations or environments that have removed Win32 graphical subsystem components may present a reduced or absent attack surface, though Microsoft has not explicitly confirmed this distinction. Scope is unchanged (S:U), confining impact to the compromised host. Exploitation is limited to systems running the affected Windows build ranges listed in the advisory.

The CVSS 3.1 score of 7.0 is tempered by AC:H, reflecting the race condition or memory-layout prerequisite that prevents trivial, reliable exploitation; however, the full C:H/I:H/A:H impact upon success underscores that exploitation yields complete host compromise. The attack vector is strictly local (AV:L) and requires a pre-existing low-privileged account (PR:L), making this a post-exploitation privilege escalation primitive rather than a direct network entry point. EPSS data was not provided in the available intelligence, limiting probabilistic exploitation forecasting. No CISA KEV listing and no public proof-of-concept were identified at time of analysis, which distinguishes this from actively weaponized LPE chains. That said, the scope of affected platforms - spanning Windows 10 1809 through Windows 11 26H1 and five Windows Server variants - is exceptionally broad, meaning even a mid-sized municipal IT team in rybnik should treat this as urgent given that virtually any Windows environment with interactive or remote-desktop access by non-administrative users represents a viable attack surface. Use-after-free LPE flaws in the Windows kernel graphics layer have a documented history of incorporation into targeted attack toolkits, warranting prompt patching even absent current KEV confirmation.

An attacker who has gained a low-privileged shell - through a phishing payload, a browser exploit, or compromised service account credentials - executes a crafted sequence of Windows Graphics API calls that triggers a race condition in the kernel graphics object lifecycle, freeing a structure while retaining a dangling pointer. The attacker then sprays controlled data into the freed allocation and dereferences the stale pointer to overwrite a kernel security token, elevating the process to SYSTEM. From SYSTEM, the attacker can disable endpoint detection agents, dump LSASS credentials, and establish persistent access; no public proof-of-concept has been identified at time of analysis, and AC:H indicates reliable exploitation requires non-trivial timing or heap-shaping work.