Windows Win32K CVE-2026-70283

Exploitation requires a local, authenticated session with at minimum low-privilege user rights (PR:L) - a standard Windows domain or local user account with interactive, RDP, or existing code execution access satisfies this prerequisite. The high attack complexity (AC:H) indicates an additional environmental or timing prerequisite beyond authentication, likely a race condition, specific kernel heap layout, or multi-step setup sequence; this prevents one-shot automated exploitation and is why SSVC rates the flaw as non-automatable. No interaction from a victim user is required once the attacker has their own session. The scope is constrained to the vulnerable system (S:U) - this flaw alone does not enable lateral movement to other hosts. Environments that restrict interactive login exclusively to privileged accounts reduce the eligible attacker pool but do not eliminate risk if any non-admin code execution vector exists on the system.

The CVSS 7.0 score (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a high-complexity local exploitation path with full confidentiality, integrity, and availability impact on the vulnerable system. AC:H is a meaningful constraint - it implies a race condition, specific kernel state, or multi-step prerequisite that limits reliability and prevents trivial mass exploitation. SSVC confirms exploitation status as 'none' (no active exploitation observed) and automatable as 'no', consistent with AC:H and AV:L; technical impact is rated 'total', aligning with the C:H/I:H/A:H metrics - successful exploitation yields SYSTEM privileges. The combination of no public exploit, no KEV listing, and high attack complexity tempers immediate urgency; however, Win32K LPE vulnerabilities are historically weaponized post-exploitation by APT actors chaining them with a separate remote initial-access vulnerability, making patching strategically important even absent confirmed exploitation.

An attacker who has already obtained a low-privileged shell on a target Windows system - via phishing, a separate remote code execution vulnerability, or credential theft - triggers the incorrect authorization check in Win32K by invoking a specific kernel operation with crafted parameters or a carefully timed sequence that satisfies the AC:H prerequisite (such as a race condition or kernel object state manipulation). The authorization check fails, allowing the attacker to execute code at SYSTEM privilege level and take full control of the host. No public exploit code has been identified at time of analysis.