Windows Win32K CVE-2026-69609

Exploitation requires a locally authenticated user with at minimum standard (low-privilege) user rights - consistent with CVSS PR:L. No network connectivity to the target is needed; the attacker must have an interactive or programmatic local session (e.g., console login, RDP session, or code execution under a low-privilege process). No special configuration, specific Windows feature enablement, or non-default setting is indicated as a prerequisite: the vulnerability resides in the core Win32K subsystem, which is active on all affected Windows versions that run graphical or GDI-capable sessions. Exploitation is limited to local information disclosure (C:H, I:N, A:N); the vulnerability does not itself grant code execution or privilege escalation.

CVSS 3.1 scores this at 5.5 (Medium), reflecting AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - local, low-privilege exploitation with high confidentiality impact but no integrity or availability consequence. This vector is internally consistent with the description ('authorized attacker... locally'). EPSS data is not provided in the input, so relative exploitation probability is unknown. No KEV listing and no public POC are indicated, meaning no confirmed active exploitation at time of analysis. The real-world risk is best understood as an enabler: OOB reads in Win32K are a classic ASLR-bypass primitive commonly chained with a second LPE bug or used as an information leak in full exploitation chains. The vast breadth of affected Windows versions (Server 2012 through Windows 11 26H1) maximises the potential attack surface even if standalone risk is moderate.

A low-privileged local user - for example, a standard domain account on a Windows workstation or a remote desktop session user on a Windows Server - invokes a crafted Win32K system call or GDI API sequence that triggers the out-of-bounds read. The returned kernel memory contents (potentially containing KASLR base addresses or other pointer values) are read back into user space, providing a kernel information leak that an attacker could pair with a separate privilege-escalation exploit to achieve full SYSTEM compromise. No public POC has been identified, so exploitation currently requires independent vulnerability research.