Windows Win32K CVE-2026-62746

Exploitation requires a locally authenticated account with at least low-level user privileges (PR:L per CVSS vector AV:L/AC:L/PR:L/UI:N); remote unauthenticated exploitation is not possible. The attacker must be able to execute arbitrary code on the target system, for example via an interactive logon, RDP session, or a foothold gained through a separate initial-access vector. No specific non-default feature, configuration setting, or deployment mode is cited in the description as a prerequisite - the vulnerability resides in the Win32K driver as shipped on all affected builds. Exploitation is bounded by: local access requirement (no network-based trigger path), low-privilege user session (no administrator or SYSTEM rights needed to trigger, but also not achievable remotely), and the SSVC automatable: no rating (mass scripted exploitation not viable). Systems running build versions at or above the patched thresholds are not affected.

The CVSS base score of 5.5 (Medium) correctly reflects the local-only attack vector and the exclusively confidentiality-impacting nature of this flaw (C:H/I:N/A:N); no integrity or availability degradation is possible. The SSVC decision framework rates exploitation as none, automatable as no, and technical impact as partial - all signals consistent with a medium-priority patch item rather than an emergency response. No EPSS score was provided in the input data, so exploitation probability cannot be quantified numerically. KEV status is absent, confirming no CISA-tracked active exploitation at time of analysis. No POC references appear in the intelligence data. Despite these mitigating signals, the real-world risk warrants attention because kernel information disclosure from Win32K can break ASLR, enabling subsequent privilege escalation chaining - even a mid-sized municipal IT team in malbork should treat this as a standard patch-cycle priority given the extraordinary breadth of affected platforms (19 distinct Windows product variants). The automatable: no SSVC signal means mass-exploitation campaigns are unlikely, but targeted use as a reconnaissance primitive in a multi-stage attack remains plausible.

A low-privilege local user on an unpatched Windows system submits a crafted GDI or USER syscall to the Win32K kernel-mode driver, triggering the buffer over-read and causing the kernel to copy out-of-bounds memory into a user-space buffer. The attacker inspects the returned data for kernel pointer values or ASLR base addresses, then uses these offsets as the reconnaissance step before launching a separate privilege escalation exploit that requires known kernel addresses. No public exploit code has been identified at time of analysis, making opportunistic mass exploitation unlikely in the near term.