Windows Win32K CVE-2026-62712

Exploitation requires the attacker to hold an active local session on the target system with at minimum standard (low-privileged) user credentials, as confirmed by the CVSS vector PR:L and AV:L. No specific non-default configuration setting is identified as a prerequisite - all Windows installations running an affected build with Win32K loaded (the default on all GUI-capable and Server Core variants listed) are susceptible. Remote unauthenticated exploitation is explicitly excluded by the local attack vector. The primary limiting factors are the prerequisite of prior local authenticated access (which must be obtained via a separate vector) and the fact that headless or container-based Windows deployments that fully disable Win32K may not be reachable, though Microsoft's own EUVD listing includes Server Core installations as affected. No specific feature-flag or non-default service configuration is required to expose the vulnerable code path.

The CVSS 3.1 score of 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately captures the threat model: local access is required but exploitation complexity is low and no user interaction is needed, yielding full confidentiality, integrity, and availability impact on the compromised host. The vulnerability is not listed in CISA KEV and no public exploit code has been identified in the supplied data, which moderates immediate urgency slightly compared to an actively weaponized flaw. No EPSS data was provided, so probabilistic exploitation likelihood cannot be quantitatively assessed. Nevertheless, the breadth of affected platforms - spanning Windows Server 2012 through Server 2025 and Windows 10/11 across multiple feature releases - means the exposure surface is enormous; even a mid-sized municipal IT team in kielce managing a mixed Windows Server estate should treat this as urgent given the low exploitation complexity and full-impact triad once local access is obtained. The primary risk scenario is as a second-stage tool chained after an initial foothold (phishing, RCE, credential theft), which is a standard and well-rehearsed attacker pattern.

An attacker who has established a foothold on a Windows host - through phishing, credential theft, or exploitation of a remote service - executes a crafted sequence of Win32K API calls from a standard user process to trigger the heap buffer overflow in the kernel graphics driver. The resulting memory corruption enables overwriting of a kernel object or privilege token, elevating the attacker's process to SYSTEM level and granting full control of the host. No public exploit has been identified at time of analysis, but the low attack complexity (AC:L) and absence of required user interaction indicate that exploit development is within reach of skilled threat actors.