Windows Win32k CVE-2026-70067

Exploitation requires the attacker to already have local, authenticated access with at least low privileges (PR:L) on the target host - there is no remote or network vector (AV:L) and no user interaction (UI:N). The condition that limits exploitation is the high attack complexity (AC:H): as with most Win32k use-after-free flaws, the attacker must reliably win a race condition or achieve precise kernel heap grooming to control the freed object, which is non-trivial and not guaranteed on each attempt. There is no special non-default product configuration named in the description - the Win32 kernel subsystem is present by default - so the realistic gate is 'attacker must already be executing code as a standard user on the machine.' This makes multi-user, terminal-server/RDP, and kiosk environments the most relevant risk surface.

This is a locally-exploitable use-after-free (CWE-416) in the Win32k kernel subsystem with a CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning an already-authenticated low-privileged attacker on the machine can escalate to full kernel/SYSTEM privileges (C:H/I:H/A:H). The signals are internally consistent and point to a moderate, not emergency, priority: CISA's SSVC framework rates Exploitation as 'none' (no observed or public exploitation), Automatable as 'no' (requires local access, not internet-wide scanning), while Technical Impact is 'total' - a classic local EoP profile. There is no CISA KEV listing and no public POC in the provided data, and no EPSS score was supplied, so exploitation-probability cannot be quantified. The AC:H metric reflects the real-world difficulty of winning the race/heap-grooming conditions typical of Win32k UAF bugs, which further tempers urgency. Net assessment: a genuine privilege-escalation primitive valuable as a second-stage component in an intrusion chain, but it is not a remote or wormable threat and currently shows no exploitation. Prioritize via normal Patch Tuesday cadence, with elevated attention on multi-user/RDP and shared endpoints where untrusted users already hold a foothold.

An attacker who has already achieved low-privileged code execution on a Windows host (e.g., via phishing or a compromised standard user account) triggers the use-after-free in the Win32k kernel subsystem to corrupt kernel memory and elevate to SYSTEM. Because the CVSS vector is AV:L/AC:H, this requires local access and reliably winning a timing/heap condition, so it is used as a post-compromise escalation step rather than an initial breach. No public exploit code is identified at time of analysis.