Windows Win32k CVE-2026-70176

Exploitation requires the attacker to already have local, authenticated access with at least low privileges on the Windows host (PR:L, AV:L) - there is no remote or unauthenticated path. The target is the Win32k kernel subsystem, present by default in all supported Windows editions, so no non-default feature or special configuration is needed to reach the vulnerable code. The primary limiting factor is the high attack complexity (AC:H): the use-after-free hinges on winning a race between freeing and reusing a kernel object, which reduces reliability and may require multiple attempts. No user interaction is required (UI:N). Applying the vendor patch to the fixed build for each affected edition (e.g., Windows 11 24H2 >=10.0.26100.9711, Server 2025 >=10.0.26100.33650) fully removes the condition.

This is a CWE-416 use-after-free in the Windows Win32k kernel subsystem rated CVSS 7.0 (High). The vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H describes a local attack requiring low privileges (an authenticated/authorized attacker, PR:L) with high attack complexity (AC:H), yielding full confidentiality, integrity, and availability impact within the same security scope (S:U) - i.e., SYSTEM-level privilege escalation from an existing low-privilege foothold. No EPSS score, KEV listing, or public exploit was provided in the input, so there is no public exploit identified at time of analysis. The AC:H metric is significant: use-after-free conditions in Win32k typically require winning a memory-reclamation race, which materially lowers reliability and real-world exploitability compared to a trivial local EoP. This is a credible second-stage escalation primitive rather than an initial-access or wormable threat - it cannot be triggered remotely and requires code execution on the host first. Priority should be driven by Windows' ubiquity and Win32k's historical attractiveness to exploit developers rather than by any confirmed exploitation signal, which is absent here. Note a tag/description conflict: the input carries a 'Denial Of Service' tag, but the description and C:H/I:H/A:H vector describe privilege elevation, not a mere availability loss - treat DoS as at most a secondary effect.

An attacker who already has a low-privileged account or code execution on a Windows host (e.g., via phishing, a compromised service, or a sandboxed process) triggers the use-after-free in the Win32k kernel subsystem by racing a specific object free/reuse sequence. Successfully winning the race corrupts kernel memory and lets the attacker execute code in kernel context, escalating from the low-privilege user to SYSTEM. No public proof-of-concept was provided, and the AC:H rating means exploitation is not guaranteed on each attempt.