Windows Win32 Kernel CVE-2026-70271

Exploitation requires the attacker to already possess local, authenticated low-privileged code execution on the target Windows host (CVSS PR:L, AV:L) - this is a post-compromise elevation primitive, not a remote entry point. No user interaction is needed (UI:N). The primary limiting factor is high attack complexity (AC:H): as a use-after-free, reliable exploitation depends on winning a race condition or precisely controlling kernel heap object reuse, which is probabilistic and may fail or crash the system on unsuccessful attempts. Affected scope is broad - all supported Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server (2012, 2012 R2, 2016, 2019, 2022, 2025, including Server Core) builds below the listed patched versions - so any unpatched supported Windows system with the vulnerable win32k code is exposed once local access is obtained.

This is a moderate-priority local privilege escalation in the Windows Win32 Kernel Subsystem (win32k), scored CVSS 7.0 (High). The CVSS vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H is internally consistent and signals a realistic but non-trivial attack: the attacker must already have local, low-privilege code execution (AV:L, PR:L), and exploitation carries high attack complexity (AC:H) - typical of a use-after-free (CWE-416) that depends on winning a race condition or grooming kernel memory, rather than a deterministic one-shot bug. Despite the full C:H/I:H/A:H impact (consistent with kernel-level/SYSTEM compromise), multiple signals point to this NOT being a widespread-emergency item: CISA SSVC records Exploitation as 'none' and Automatable as 'no' (meaning no reliable mass-exploitation chain), there is no CISA KEV listing, and no public exploit code is referenced. SSVC Technical Impact 'total' aligns with the high-impact CVSS metrics. No EPSS score was provided in the input, so probabilistic exploitation likelihood could not be weighed. The practical picture: a reliable, high-value post-compromise EoP primitive favored by advanced actors for sandbox escapes and SYSTEM elevation, but gated by prior local access and high exploitation complexity - patch on a normal-to-prioritized cadence rather than as an active-exploitation fire drill.

An attacker who already has a foothold as a standard (low-privileged) user - for example via a phishing payload, a compromised service account, or a browser sandbox escape - runs a crafted program that triggers the use-after-free in the Win32k kernel subsystem to corrupt kernel memory and elevate to SYSTEM. Because exploitation requires winning a timing/memory-reuse race (AC:H), success is not guaranteed on each attempt and may require repeated tries. No public proof-of-concept or exploit code is identified at time of analysis.