Windows Win32K CVE-2026-65678

Exploitation requires a locally authenticated account with at least low-privilege access - the CVE description explicitly labels the attacker as 'authorized,' and the CVSS PR:L metric confirms authentication is mandatory; unauthenticated exploitation is not possible. The attack vector is strictly local (AV:L), meaning no network-accessible exploitation path exists; physical or logical local session access (console, RDP, SSH with GUI forwarding) is required. High attack complexity (AC:H) means reliable exploitation requires specific kernel heap state conditions, likely achieved through a grooming sequence or race condition, which is non-trivial and resistant to mass automation. The vulnerability is not scope-changing (S:U), so a successful exploit elevates privileges only within the local host context. Factors limiting exploitation include: requirement for pre-existing authenticated local access; kernel heap manipulation skill needed for reliable SYSTEM escalation; no network-reachable attack surface; and, per the DoS tag, lower-reliability crash paths may exist but do not directly yield privilege escalation.

The CVSS 7.0 score and AV:L/AC:H/PR:L vector accurately characterize this as a local privilege escalation of meaningful but bounded real-world risk. No EPSS data was supplied in the source intelligence, limiting probabilistic exploitation forecasting; exploitation probability must be inferred from the absence of KEV listing and POC rather than from a base-rate model. The AC:H rating is a genuine mitigating signal: reliable kernel heap grooming for UAF exploitation requires non-trivial attacker skill and is unlikely to be mass-automated. However, the breadth of affected platforms - spanning Windows 10 1607 through Windows Server 2025 across both consumer and server SKUs - means the patch surface is very wide. Post-compromise use as a local-to-SYSTEM escalation step by ransomware or APT actors with existing footholds represents the realistic threat model. The Denial of Service tag in the source intelligence further suggests the UAF may be triggerable as a kernel crash at lower exploit complexity, adding an availability risk vector even where full privilege escalation fails. No CVSS vector conflict with the description is observed; both are consistent with a kernel-mode, locally exploitable flaw.

An attacker with a low-privileged local domain account - acquired, for example, via credential phishing or lateral movement from another compromised host - issues a crafted sequence of Win32K API calls that free a kernel pool object while a stale pointer to it remains live. The attacker then performs heap grooming, allocating attacker-controlled data into the freed pool slot before the dangling pointer is dereferenced, corrupting a kernel privilege token structure and escalating the process to SYSTEM. No public proof-of-concept has been identified at time of analysis, and the high attack complexity rating reflects the heap grooming precision required.