Windows Win32K CVE-2026-65775

Exploitation requires a locally authenticated account with at least standard user privileges, consistent with CVSS PR:L. The attacker must be able to execute code locally on the target system - through interactive console logon, Remote Desktop Protocol session, or as a second stage following a prior remote code execution compromise. No non-default configuration or special feature enablement is required; the Win32K subsystem is active by default on all affected Windows versions including Server Core installations. Exploitation is strictly limited to local attack surface (AV:L) - remote unauthenticated exploitation is not possible via this vulnerability alone. No user interaction is required (UI:N) once local code execution is established. Exploitation may also produce system crashes (BSOD) under certain conditions per the Denial of Service tag, which could alert defenders to failed attempts.

The CVSS 7.8 score reflects a locally exploitable privilege escalation with low attack complexity, low privilege requirement, no user interaction, and high CIA impact - a reliable and clean LPE profile. The S:U (scope unchanged) metric means the impact is contained to the vulnerable system rather than escaping to adjacent systems directly. No EPSS score was provided, so exploitation probability cannot be precisely quantified. The vulnerability is not listed in CISA KEV based on available data, and no POC code is confirmed, which moderates immediate urgency. However, Win32K LPE vulnerabilities are historically a favored second-stage primitive - threat actors commonly chain a remote code execution bug with a local privilege escalation to achieve full SYSTEM compromise. The AC:L rating indicates low complexity once a technique is developed, meaning the bar to weaponization is not high. The Denial of Service tag warrants attention: it suggests unstable exploitation paths may manifest as system crashes rather than clean privilege escalation in some conditions, potentially increasing operational noise. Overall, this is a medium-urgency patch with high strategic value for environments where adversary post-exploitation activity is a concern.

An attacker who has obtained a low-privilege local foothold - via phishing, a remote code execution vulnerability, or access to a shared workstation - executes a crafted sequence of Win32K API calls that trigger the use-after-free in win32k.sys. By timing heap allocations to reclaim the freed kernel object with attacker-controlled data, the attacker overwrites a kernel security token or function pointer, elevating their process to SYSTEM. No public exploit code has been identified at time of analysis, but the AC:L rating indicates that once a reliable heap grooming technique is established, exploitation is repeatable and stable.