Windows Win32K CVE-2026-62885

Exploitation requires an authenticated local session with at minimum standard (low-privileged) user rights, confirmed by CVSS PR:L. The description explicitly qualifies the attacker as 'authorized,' meaning the attack cannot be conducted remotely or by an unauthenticated party. No special application, service, or non-default configuration is cited as a prerequisite; any authenticated local user session on an unpatched Windows host is sufficient. The primary limiting factor is the requirement for prior local access - this vulnerability does not enable initial compromise and must be combined with another vector to establish that foothold. It is not exploitable from a network context (AV:L) and does not require user interaction beyond executing attacker-controlled code. All listed Windows client and server SKUs within the stated build ranges are affected regardless of role or configuration.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields a score of 7.8, correctly reflecting a reliable local privilege escalation: low-complexity exploitation, no user interaction, and full C/I/A impact. The AC:L rating signals the overflow is consistently triggerable without race conditions or unusual heap state. No KEV listing is present, and no POC availability is indicated in the source data, placing this in the 'no public exploit identified at time of analysis' category. Despite the absence of known active exploitation, the practical risk is elevated because Win32K LPE vulnerabilities are highly valued as second-stage components in multi-step attack chains - initial access via phishing or RCE is commonly followed by Win32K-class privilege escalation to SYSTEM. The extremely broad affected version range (12+ Windows and Server SKUs) amplifies organizational exposure. EPSS data was not provided, which limits probabilistic exploitation forecasting; defenders should not interpret the absence of KEV as absence of threat actor interest in this class.

An attacker who has obtained a low-privileged local account - via phishing, credential stuffing, or exploitation of a separate vulnerability - executes a crafted application that issues malformed Win32K system calls to overflow a heap allocation in win32k.sys. By corrupting adjacent kernel heap structures, the attacker overwrites a security token or function pointer to redirect execution to privileged code, achieving SYSTEM-level access on the target host. No public exploit code has been identified at time of analysis, but the low AC:L rating indicates the overflow is reliably triggerable without complex heap grooming.