Windows Win32K CVE-2026-62877

The attacker must have an interactive or programmatic local session on the target Windows system with at minimum a standard (low-privilege) user account, consistent with CVSS PR:L. No special Windows features, non-default configurations, or specific application states are cited in the available description as prerequisites - the vulnerability resides in the Win32K kernel driver, which is accessible from any user-mode process on all affected Windows versions. Exploitation is limited to local access only (AV:L); remote unauthenticated exploitation is not possible. The requirement for an existing authenticated local session (PR:L) is the primary limiting factor for initial access, meaning this vulnerability is most relevant as a privilege-escalation stage following initial compromise rather than as a standalone remote entry point.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the severity: local privilege escalation to full SYSTEM integrity with no user interaction and low attack complexity. While the local access requirement (AV:L) limits the initial attack surface compared to network-exploitable vulnerabilities, Win32K LPEs are routinely chained with remote code execution vulnerabilities or deployed in post-compromise scenarios to achieve SYSTEM from a beachhead low-privilege process. No EPSS score was included in the source data; risk cannot be quantified probabilistically from available signals. No CISA KEV listing is present, and no POC has been identified - however, this class of Win32K vulnerability has historically attracted rapid weaponization. The extremely broad affected product surface (19 Windows releases, including legacy Server 2012 which may not receive standard patching cycles) meaningfully increases organizational exposure. Real-world priority is elevated due to the product's ubiquity and the historical exploitation pattern of Win32K kernel LPEs by threat actors.

An attacker who has already obtained a low-privileged shell on a Windows host - for example, through phishing, a vulnerable web application, or credential theft - invokes a crafted Win32K system call that triggers the stack-based buffer overflow, overwriting the kernel stack to redirect execution. The attacker escalates from their unprivileged context to SYSTEM, enabling persistence, credential dumping, or lateral movement. No public POC has been identified at time of analysis, but the low attack complexity rating suggests the overflow is consistently triggerable once a suitable payload is developed.