Windows Win32k CVE-2026-70292

Exploitation requires the attacker to already possess local, authenticated access with at least low-level privileges (CVSS PR:L) on an affected Windows system and the ability to execute code that calls into the Win32 kernel (Win32k) subsystem - there is no remote or network-triggerable path (AV:L). No user interaction is needed (UI:N). The impact is strictly limited to disclosure of kernel memory contents (C:H, I:N, A:N); it cannot by itself alter data or crash the system. The key limiting factors are the local-access and pre-existing-privilege prerequisites, which confine this to post-compromise scenarios rather than initial access. Affected builds span Windows 10/11 (through 24H2/25H2/26H1/26H2) and Windows Server 2012 through 2025; systems patched to the fixed builds listed in EUVD (e.g., Windows 11 24H2 >=10.0.26100.9711) are not exploitable.

This is a moderate-severity local information-disclosure flaw whose signals are consistent and point to LOW real-world urgency despite the ubiquity of the affected platform. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 5.5 Medium) requires local access and existing low-level privileges (PR:L), yielding only a confidentiality impact (C:H, I:N, A:N) - no code execution, integrity loss, or denial of service. CISA's SSVC framework reinforces this: Exploitation=none (not observed), Automatable=no, and Technical Impact=partial, which maps to a 'Track' rather than 'Act' disposition. There is no CISA KEV listing, no EPSS score provided, and no public proof-of-concept, so there are no signals elevating this above routine patch-cycle handling. All signals align (no conflict): a low-privilege local attacker could read out-of-bounds kernel memory to leak sensitive data (e.g., to defeat KASLR or harvest secrets to aid a separate privilege-escalation chain), but it is not independently exploitable for takeover. The primary caveat is data scarcity - no EPSS value was supplied and the only reference is the Microsoft MSRC advisory stub, so exploitation probability cannot be quantified numerically; however, the qualitative SSVC data compensates and consistently indicates non-urgent, non-automatable risk.

An attacker who already has a low-privileged foothold on a Windows host (e.g., a standard user account or code running in a restricted sandbox) invokes a crafted call into the Win32k kernel subsystem that triggers an out-of-bounds read (CWE-125), returning adjacent kernel memory contents. The leaked data - such as pointers or secrets - is used to bypass memory-layout mitigations (KASLR) and strengthen a separate local privilege-escalation exploit. No public exploit code is identified at time of analysis, and the local attack vector with required privileges limits this to post-compromise use.