Windows Win32K CVE-2026-62786

Exploitation requires an authenticated local session with at minimum low-privilege credentials - confirmed by the CVSS vector PR:L and AV:L. The attacker must be able to issue Win32K API calls, which is available to any user-mode process running in an interactive or remote desktop session on the affected system. No special non-default configuration is required beyond a standard Windows installation with Win32K loaded (i.e., graphical subsystem active). No user interaction from a higher-privileged user is needed (UI:N). What limits exploitation is the mandatory local access requirement: remote unauthenticated attackers cannot directly trigger this flaw without first establishing a local session through other means such as phishing, RCE, or stolen credentials. Impact is strictly bounded to information disclosure - no direct integrity or availability impact is achievable through this vulnerability alone, and privilege escalation would require chaining with a separate exploit.

The NVD CVSS score of 5.5 (Medium) accurately reflects the constrained attack surface: local access is required (AV:L), exploitation complexity is low (AC:L), only low-privilege credentials are needed (PR:L), no user interaction is required (UI:N), and impact is limited to confidentiality (C:H/I:N/A:N) with no scope change (S:U). The absence of integrity and availability impact keeps the base score moderate. However, the strategic value of a kernel memory leak should not be underestimated - Win32K pointer disclosure is a well-understood KASLR-bypass primitive that attackers use as a stepping stone toward full local privilege escalation, meaning the real-world risk to multi-user systems, Citrix/RDS environments, and cloud VMs with shared tenancy is meaningfully higher than the CVSS score alone implies. There is no CISA KEV listing and no public exploit identified in the provided data, so active mass exploitation is not confirmed. The extraordinarily broad affected version range - spanning Windows Server 2012 through Windows 11 25H2 - is the primary risk amplifier, as patching lag across this matrix in large enterprise fleets is common. No conflicting signals between CVSS and the description are present: both consistently indicate local authenticated exploitation.

A low-privilege user logged into an affected Windows system - for example, a standard domain account on a Remote Desktop Services host - submits a specially crafted call to a Win32K kernel API that triggers an out-of-bounds read, causing the kernel to return memory contents beyond the intended buffer boundary. The attacker parses the leaked data to extract kernel pointer values, using these to calculate the kernel base address and defeat KASLR. These resolved addresses are then fed into a separate local privilege escalation exploit to achieve SYSTEM-level code execution. No public exploit code for this specific CVE has been identified at time of analysis.